Re: [PHP] Stopping stolen / spoofed / linked sessions

[Rasmus Lerdorf]

> I want to use PHP4 sessions for authentication,

Ok, stop right there.  Sessions and authentication have nothing to do with
each other.  To create a secure authenticated site you should be using
HTTP-based authentication over SSL.  Sessions are simply for maintaining
state across http requests and have nothing to do with authentication.

-Rasmus


-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]