lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
From: bf at open-medium.com (Bartlomiej Frackiewicz) Subject: defense against session hijacking Hi, Am Mon, 2003-11-17 um 22.16 schrieb Thomas M. Duffey: > method to protect against such an attack? It's not perfect but should > significantly increase the difficulty of such an attack with little or > no annoying side effects for the legitimate user. Would it be useful > to extend the session modules of the common Web scripting languages > (e.g. PHP) to enable an IP address check by default? why you don't force session handling with cookies and set session lifetime to 20mins (or so)? Bart
Powered by blists - more mailing lists