RE: [PHP] Re: [PHP-DEV] cookies and sessions security

2001-01-16 Thread Jason Murray
> Ach, oy vey! Then, having looked at AOL's info, it seems to me that > perhaps one could build a function or class that could evaluate > against a known list of alternate proxies. So, if the request came > from 152.163.197, it would recognize that as an AOL proxy and just > code the current p

Re: [PHP] Re: [PHP-DEV] cookies and sessions security

2001-01-15 Thread Kristofer Widholm
At 14.54 -0500 01-01-15, Tim Zickus poked the keyboard as follows: > > Wow, I never thought of using the remote IP! Thanks for the tip. I >> am going to use it today for an authentication system I'm building. > >Please note that remote IP is NOT reliable. For clients behind the proxies >& gate

RE: [PHP] Re: [PHP-DEV] cookies and sessions security

2001-01-15 Thread Jason Murray
> >Very good: keep the thing on a secure connection all the time, set a > >session id cookie and keep all user info (possibly including > >remote ip) in the server's session db... (vulnerable to nothing I can > think of at the moment...) > > Wow, I never thought of using the remote IP! Thanks

Re: [PHP] Re: [PHP-DEV] cookies and sessions security

2001-01-15 Thread Tim Zickus
> Wow, I never thought of using the remote IP! Thanks for the tip. I > am going to use it today for an authentication system I'm building. Please note that remote IP is NOT reliable. For clients behind the proxies & gateways of large ISP's (AOL is the prime example) you can see the remote addre

RE: [PHP] Re: [PHP-DEV] cookies and sessions security

2001-01-14 Thread Jason Murray
> Very good: keep the thing on a secure connection all the time, set a > session id cookie and keep all user info (possibly including remote ip) > in the server's session db... (vulnerable to nothing I can think > of at the moment...) > > There are probably more things you could do I haven't th