Re: [PHP] Stopping stolen / spoofed / linked sessions

[Jason Brooke]

> > I want to use PHP4 sessions for authentication,
>
> Ok, stop right there.  Sessions and authentication have nothing to do with
> each other.  To create a secure authenticated site you should be using
> HTTP-based authentication over SSL.  Sessions are simply for maintaining
> state across http requests and have nothing to do with authentication.
>
> -Rasmus

So setting a 'loggedin' session variable once a person has authenticated, and
checking for that session variable each request before proceeding is not ok?

jason




-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]