Re: losing session data with cross-site scripting

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Steve Lefevre wrote:
I have a php site on a production server. The production server doesn't have the spell libraries, and rather than migrate the site, we setup spell checking functions on the development site, and shuttled the users back and forth with specially crafted get links and forms.

The POST form or GET link on the production site contains the string to be spellchecked. Once the user is at the development site, the string is spellcheck, and corrected if necessary. The development site checks the http referrer to make sure it's not just anybody, and the only thing it does is spell checking, anyway.

Many users disable or set their browsers to spoof referrer headers. This isn't a good thing to rely on and it may well be causing your problem.

--
Jasper Bryant-Greene
Freelance web developer
http://jasper.bryant-greene.name/

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux