RE: [PHP] Re: [PHP-DEV] cookies and sessions security

2001-01-16 Thread Jason Murray
> Ach, oy vey! Then, having looked at AOL's info, it seems to me that > perhaps one could build a function or class that could evaluate > against a known list of alternate proxies. So, if the request came > from 152.163.197, it would recognize that as an AOL proxy and just > code the current p

Re: [PHP] Re: [PHP-DEV] cookies and sessions security

2001-01-15 Thread Kristofer Widholm
At 14.54 -0500 01-01-15, Tim Zickus poked the keyboard as follows: > > Wow, I never thought of using the remote IP! Thanks for the tip. I >> am going to use it today for an authentication system I'm building. > >Please note that remote IP is NOT reliable. For clients behind the proxies >& gate

RE: [PHP] Re: [PHP-DEV] cookies and sessions security

2001-01-15 Thread Jason Murray
> >Very good: keep the thing on a secure connection all the time, set a > >session id cookie and keep all user info (possibly including > >remote ip) in the server's session db... (vulnerable to nothing I can > think of at the moment...) > > Wow, I never thought of using the remote IP! Thanks

Re: [PHP] Re: [PHP-DEV] cookies and sessions security

2001-01-15 Thread Tim Zickus
> Wow, I never thought of using the remote IP! Thanks for the tip. I > am going to use it today for an authentication system I'm building. Please note that remote IP is NOT reliable. For clients behind the proxies & gateways of large ISP's (AOL is the prime example) you can see the remote addre

[PHP] Re: [PHP-DEV] cookies and sessions security

2001-01-15 Thread Kristofer Widholm
>Poor security: log in with a form or basic authentication; set cookie on >client with username/password combo (vulnerable to network sniffers, >anybody with access to browser's cookie file) >Decent security: log in with form or basic authentication; set cookie with >session id number and store us

RE: [PHP] Re: [PHP-DEV] cookies and sessions security

2001-01-14 Thread Jason Murray
> Very good: keep the thing on a secure connection all the time, set a > session id cookie and keep all user info (possibly including remote ip) > in the server's session db... (vulnerable to nothing I can think > of at the moment...) > > There are probably more things you could do I haven't th

[PHP] Re: [PHP-DEV] cookies and sessions security

2001-01-14 Thread Toby Butzon
Please note: The php-dev list is for developers of PHP (who create/maintain PHP, which is written in C); questions about programming in PHP should be addressed to [EMAIL PROTECTED] For more information, please see php.net/support.php. ---shifted to php-general from php-dev--- > I would like to as