|
Php and "Cookie Poisoning"
If all that is kept in a cookie is a php session identifier then is "Cookie Poisoning" of any concern? All of the cookie poisoning examples I have seen are exploited when someone puts something sensitive in a cookie.
There is still a Session Hijacking threat with the Session ID, but that can be met by checking if the user-agent and/or IP has changed between requests.
|
