I still reckon it does, I believe you can't or its difficult to fake those values (but I could be wrong) i.e. IP address and xhttp_forwarded_for. So when a client logs on you store these values, upon each request you check if the session still matches with their the values, if not then its not the person anymore.
Only thing that could have happened is the user disconnected his dial-up and reconnected, or its another person. But, anyone correct me if I'm wrong... Sjeesh, I could be wrong a lot... I wonder if I'm ever sure of myself ;-)) Taco Fleur Blog http://www.tacofleur.com/index/blog/ Methodology http://www.tacofleur.com/index/methodology/ 0421 851 786 Tell me and I will forget Show me and I will remember Teach me and I will learn > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf > Of Mark Stanton > Sent: Tuesday, 20 January 2004 7:30 PM > To: CFAussie Mailing List > Subject: [cfaussie] RE: Old Post RE: Browser Sessions - elaborate > > > > If you need security just use HTTPS, all the rest of that CGI > > information (remote IP & xhttp_forwarded_for) is also > getting passed > > in plain text so it does add any real value in terms of security > > (http://en.wikipedia.org/wiki/Security_through_obscurity). > > Sorry "...so it does add any real value in terms of security" > should have read "...so it does *NOT* add any real value in > terms of security". > > > Cheers > > Mark > > > ------------------ > Mark Stanton > Technical Director > Gruden Pty Ltd > Tel: 9956 6388 > Mob: 0410 458 201 > Fax: 9956 8433 > http://www.gruden.com > > > --- > You are currently subscribed to cfaussie as: > [EMAIL PROTECTED] To unsubscribe send a blank email to > [EMAIL PROTECTED] > > MXDU2004 + Macromedia DevCon AsiaPac + Sydney, Australia http://www.mxdu.com/ + 24-25 February, 2004 --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MXDU2004 + Macromedia DevCon AsiaPac + Sydney, Australia http://www.mxdu.com/ + 24-25 February, 2004
