Posted by peter on 11/03/06 12:11

> Seems a pain to me, plus I have read that passing the id in URL is a
> security problem, bookmarking etc.

Just make sure you are validating the sessions properly between calls.
Cookies can be just as much a security risk. Take a look at the likes of the
following:-

http://adriaangraas.feetback.nl/browse.php?vf=/security/exploits/hotmail/how-to.php

another method is to sniff the network. If you do not validate your session
properly then any method is a security risk.

[Back to original message]