|
Posted by Czapi on 02/22/07 16:04
Erwin Moller wrote:
> I say it is a myth that passing PHPSESSID by URL is less secure than passing
> it by cookie.
> Anybody who can eavesdrop on the traffic between the client and server can
> see the PHPSESSID, in a cookie, or in the URL.
> The content of the cookie is just plain there for anybody to read: in plain
> text.
Simple explanation, try to perform session fixation by sending an URL
over an email client or IM with trans_sid turned off.
--
Cz.
Navigation:
[Reply to this message]
|