Title: Message
|
The
problem when connecting through a service that proxies connections is the users
ip address can change during their session. Imail handles this poorly. Where
they should use a cookie to validate the session against the url they don't,
they rely on the ip address (checking) or no ip address (no
checking).
Connecting throught a proxy server makes no difference with checking is
turned off. If the url is known then the session can be hijacked proxy or no
proxy
Kevin
Dear Kevin,
Does this mean that the users that are connecting
to the same proxy server will still have the same issue where they can go into
other's email account with the URL ?
Rgrds,
Zul
----- Original Message -----
Sent: Wednesday, January 19, 2005 11:29
AM
Subject: RE: [IMail Forum] IMail 8.15
Security Issue !
There is a setting in the web service called "ignore source address
in security check". Uncheck the box. Now with that said users from ISPs
that proxy their users will have difficulty staying connected. When their ip
address changes they will need to log in again. This is a problem with
useres that connect form AOL.
Kevin Bilbee
Hi,
I just found out that if I login to my
webmail, view one of the email or open a folder and copy the current URL
on the address bar and open the URL at other pc or terminal, I will be
able to view or go into my account without login in.
This will work if my session is still there
or I'm still login in.
Any fix or solution for this ?
Thank you.
Rgrds,
Zul
|
