Not having a good run tonight - I just re-read my post & I can see where the confusion is:
"Small side note - I've heard people say that CFID/CFTOKEN is insecure because people sitting in the middle (like at an ISP) can sniff the URL & hijack the session." What I meant was I've heard people say that passing the PIN through the URL is insecure (regardless of what language you are using or what the variable names are). What I am saying is passing it through a cookie headers doesn't make it any more secure. If you are passing any information between the client & the server in plain text - that information is not secure. Any site that sends login information or session identifiers in plain text is only keeping honest people honest. The site can be hacked by any 16 year old with the right tools. If you mention the word "security" to any client you MUST use HTTPS. Cheers Mark ------------------ Mark Stanton Technical Director Gruden Pty Ltd Tel: 9956 6388 Mob: 0410 458 201 Fax: 9956 8433 http://www.gruden.com --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MXDU2004 + Macromedia DevCon AsiaPac + Sydney, Australia http://www.mxdu.com/ + 24-25 February, 2004
