atom feed7 messages in org.apache.tomcat.usersRE: [Q] Session invalidation and auth...
FromSent OnAttachments
Luke TaylorAug 14, 2000 2:03 am 
java programAug 14, 2000 3:57 am 
Craig McClanahanAug 14, 2000 1:29 pm 
Joe ShevlandAug 14, 2000 1:51 pm 
William BrogdenAug 14, 2000 3:33 pm 
Craig McClanahanAug 14, 2000 3:39 pm 
William BrogdenAug 14, 2000 3:52 pm 
Subject:RE: [Q] Session invalidation and authentication mechanism
From:Joe Shevland (shev@kpi.com.au)
Date:Aug 14, 2000 1:51:11 pm
List:org.apache.tomcat.users

Any indication of a release of 3.2 in the wind or is it likely to go through some more beta phases?

Cheers, Joe

A couple of notes that relate to the way Tomcat itself does this:

* As of version 3.2, the algorithm used to calculate the next session ID has been made *much* harder to calculate the next session ID value. Of course, nothing stops a snooper from swiping the session ID of a current session unless you are running across an encrypted connection (see more below on this topic). [snip]

Craig McClanahan