|
Posted by Kim Andrι Akerψ on 01/05/07 13:08
knal wrote:
> I'd like to keep out unwanted guests. Members that have registered
> (stored in MySQL DB) are allowed to login with usern/passw.
> Along with that an admin-level is stored wich tells the site how much
> rights the user has.
>
> I know i can manage the login via sessions, but i've read only
> sessions isn't secure. (Users can even "manually" force their own
> Session id). I don't really else know how to explain what i mean
> with "secure".
So basically, "secure" as in "trusted".
I've created a method that stores the user's IP address and user agent
string in session variables. Users behind the same public IP address as
the original user may be able to forge the session ID, though.
http://dev.bd0.net/test/sessions_trusted.phps
--
Kim AndrΓ© AkerΓΈ
- kimandre@NOSPAMbetadome.com
(remove NOSPAM to contact me directly)
Navigation:
[Reply to this message]
|