Re: ASP Cookieless Sessions (WAS Re: Apache::ASP)

[Serge Sozonoff]

Hello,

>It will work fine, but the problem still remains that the 
>incoming page URL has the session-id in it, so that when you go 
>offsite, the referer header sent by the client has the client's 
>session id in it still, and the unethical webmaster could easily 
>then access the users sessions by looking at the referer logs.

There is a little article about cookie-less sessions at:

www.webdevelopersjournal.com/columns/stateful.html

Serge

!--------------------------------------!
! Serge Sozonoff               !
! http://www.skiphotos.ch  !
!--------------------------------------!