At 04:33 PM 9/14/2011, Stephan Beal wrote:
>....
>i think if we got rid of (gasp!) the IP check we could easily
>implement this, but i can't just take that part out without a
>blessing from the higher powers.
I found a thread that I started back in March of 2010 about this
from a user experience point of view. The thread stalled out
after a patch was offered by Kyle McKay[1] that would have
dropped the use of the IP adderss in the session cookie hash,
allowing the same session cookie to be used from any IP address
until the session was explicitly logged out.
[1]:
http://www.mail-archive.com/[email protected]/msg01621.html
It appears that DRH was ahead of the curve in making sessions
unique to a specific IP, the issue with all the major sites that
is exploited by session sniffing apps such as the infamous
firesheep plugin.
I should be possible to support more than one session cookie per
user, but then you would need a process to occasionally purge
stale sessions from the server. You could do that check on any
session validation, if its been long enough since the last check.
Or at least check a few sessions on each validation if that is
expensive to do en masse.
Ross Berteig [email protected]
Cheshire Engineering Corp. http://www.CheshireEng.com/
_______________________________________________
fossil-users mailing list
[email protected]
http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
