[Savannah-hackers] Re: [Bug #1260] New "nongnu.org" site breaks sessions and prefs

[Mathieu Roy]

Yann Dirson <address@hidden> said:

> On Wed, Sep 25, 2002 at 09:36:43AM +0100, Jaime E. Villate wrote:
> > I think our best option at this moment is to move theme prefs from the 
> > cookies
> > into the database (as it was originally in SourceForge). I know that Mathieu
> > had some good reasons to switch theme prefs from the database to a cookie, 
> > but
> > at this moment I think it is a high priority to make life easier for 
> > Savannah users.
> 
> Or, maybe better, have the info both in the DB for
> registered/logged-in users, to provide cross-site propagation, and in
> cookies for logged-out operation ?

Can you give me example of website storing "logged-in infos" without
using cookies ?

By storing IP informations in the database? If a dynamic IP user
forget to log out, someone can steal his account with ease. If a
someone use savannah from a network connected to internet by IP
masquerading (as me, for instance), everyone on his local network can
stole his account. 
I do not get how you can secure a login/logout system without using
cookies. Using IP is definitely unsafe. Neither other informations web
browser tells to the server are, since they can be modified and
guessed.



-- 
Mathieu Roy
 
 << Profile  << http://savannah.gnu.org/users/yeupou <<
 >> Homepage >> http://yeupou.coleumes.org           >>
 << GPG Key  << http://gpg.coleumes.org              <<