|
|
Posted by shimmyshack on 11/02/06 00:43
well said. defence against the dark arts is hard.
If you want to add to your session security and enforce even more than
the above, things like application-state-pathways, further
authentication for sensitive parts of the site, intelligent semi-trust
for certain users based on actions, restarting new sessions
transparently (including on login and logoff), sending the initial
session token over SSL and more, go ahead
This is a pretty good place to begin
http://www.owasp.org/index.php/PHP_Top_5
note the references there for further reading.
Sessions can be very tricky if you want things to be secure.
The more you read the more fun it gets.
Dont have nightmares, do sleep well
Navigation:
[Reply to this message]
|