7 messages in ru.sysoev.nginxRe: help: How to track user session w...
FromSent OnAttachments
Yingyuan ChengOct 25, 2007 2:21 am 
焦胜强Oct 25, 2007 2:54 am 
Yingyuan ChengOct 25, 2007 3:28 am 
Maxim DouninOct 25, 2007 4:00 am 
Valery KholodkovOct 25, 2007 4:34 am 
Yingyuan ChengOct 25, 2007 6:08 pm 
Yingyuan ChengOct 25, 2007 6:31 pm 
Actions with this message:
Paste this link in email or IM:
Paste this link in email or IM:
Atom feed for this thread
Paste this URL into your reader:
Subject:Re: help: How to track user session with fastcgiActions...
From:Valery Kholodkov (vale@public.gmane.org)
Date:Oct 25, 2007 4:34:03 am
List:ru.sysoev.nginx

If you want some way to assign session id to user for security/external data storage identifier etc (the "sessions" in php's meaning) - you should use other means to generate them.

Note: cookies generated by userid module shouldn't be used as security identifier, since malicious user can easily guess other user's cookie.

You could implement signed cookies like OpenACS or Django do:

http://openacs.org/doc/current/security-design.html

http://code.djangoproject.com/ticket/3285