Welcome Guest, Not a member yet? Register   Sign In
Some security concerns with session libary
#11

[eluser]WanWizard[/eluser]
The problem with that solution is that if your user is active in the application, but happen to visit pages that don't need a session update, your session cookie will not be updated.

Immediate result is that the session id will not be rotated (which is a security issue), less immediate is that your session will expire, and your user will be logged out, leaving a puzzled user because there was no inactivity.

In short, bad idea.




Theme © iAndrew 2016 - Forum software by © MyBB