Posted by Erwin Moller on 11/17/06 09:16

Chung Leong wrote:

> Erwin Moller wrote:
>> The name of the file reflects the sessionid.
>> So both are comprimised...
>
> But if there are other variables in the cookies, they won't be
> compromised. That's the point I was getting at.

Allright. Agreed. :-)

>
>> I don't get that Cheong, what goes excactly wrong with JS in combination
>> with trans_sid? I use btoh a lot, so I am curious what you mean.
>
> Let me clarify. I mean when you have URLs generated through Javascript,
> then these won't be transparently handled.

True. But you can of course add them yourself in your script.
But yes, it is a little bit more work.
But the advantage is that people without cookies can still use your
(JS-enabled) webpages.

And sorry I misspelled your name Chung. :-)

Regards,
Erwin Moller

[Back to original message]