Session Fixing Library

[eluser]WanWizard[/eluser]

In the default library, decrypting the cookie gives you access to the complete content of the session

Not when the session data is stored server-side, which you should ALWAYS configure.

In that case, the cookie only contains:

Code:

foreach (array('session_id','ip_address','user_agent','last_activity') as $val)

So no payload in the cookie.

This invalidates your other points too, as they are based on the assumption that session data is stored client side.