Posted by Rik on 03/09/07 03:28

Gordon Burditt <gordonb.o54mo@burditt.org> wrote:

>>> >> That's what you don't get. www.example.com is NOT the same as
>>> >> example.com.
>>
>> Yes it is - for any domain issued

OMFG! Back to school. Don't pretend to now anything anymore.

>> denying that simple fact allows PHP
>> to continue to ignore a security critical bug. A fact easily tested.

So you're the reason so many bug report sites are cluttered, out of date=
, =

and seriously slow.

> The same applies to sessions. If the browser doesn't send a session
> cookie because the hostname is different, PHP has no way to know
> if it was part of a session. There's no way for PHP to fix this,
> short of a mind-reading protocol. Even that wouldn't work unless
> browsers were made intelligent enough to have a mind to read.

Time to implement DWIM() :-)
http://ars.userfriendly.org/cartoons/?id=3D20011121

>> Try going to any site with either and you get the same result unless
>> its a very old domain. Nobody is now issued with a domain where those=

>> 2 addresses result in a different IP address. Nobody.

What 'issued'? Configured you mean? Ad how much research have you done o=
n =

the subject? Hardly anything i'd imagine.

Also, often there are a lot of websites running on the same IP. Should t=
he =

browser sent out cookies to totally unrelated sites that just happen to =
=

have the same hoster?

>> the WWW is just a convention that means nothing in relation to the
>> domain.

It is a subdomain. Get it?

>> PHP using sessions constitutes a massive security hazard until this
>> serious bug is fixed.
>
> The same so-called "bug" exists even if you uninstall PHP.

And I wouldn't call it a security hazard if users can't login. 't Would =
be =

more of a hazard if they can log in with wrong credentials. And the mome=
nt =

my browser is sending out cookies to different domains then those that s=
et =

them it the moment I trash it for another one.
-- =

Rik Wasmus
Posted on Usenet, not any forum you might see this in.
Ask Smart Questions: http://tinyurl.com/anel

[Back to original message]