Talk:Session fixation

message: This topic is already mentioned on the Session_hijacking article and the two issues overlap greatly. It seems it would be easiest to deal with both at once. Blackthirteen 22:33, 25 September 2007 (UTC)
thread_title:  Merger proposal 

message: I tried to polish this article's writing somewhat.  I tried to eliminate as many adjectives as I could and clean up the "I am giving you a tutorial" tone of the article.  Much remains to be done, of course.  There needs to be more information and slightly less tutorial.  However, I kept everything that was there in some form because, reading this for information, I found it helpful.  Bluesprite 00:49, 8 April 2007 (UTC)
thread_title:  Spelling and Grammar 

message: A lot of the examples in this article make reference to the PHP language.  I'd like to see one of the following: either (a) the code is rewritten in easy-to-read pseudocode, or (b) the code is fixed so it is syntatctically correct PHP. A Pattern O 04:13, 11 April 2006 (UTC)
replies: text: I fixed the PHP a few hours ago, but pseudocode, or removing the examples entirely and making the article less of a howto, would be better. --Matt Nordhoff (talk) 08:07, 20 November 2006 (UTC)
thread_title:  PHP use in article 

message: In the sample attack, what the hell is a 'saldo' feature? Is that some kind of metasyntactic variable that I've never heard of? Audiodude 04:28, 8 May 2006 (UTC)
thread_title:  Saldo? 

message: The tutorial-style content from this article would be good to include in the PHP Wikibook: Wikibooks:Programming:PHP/sessions#Avoiding_Session_Fixation.  —Sam Wilson (Australia) (talk) 23:36, 7 May 2008 (UTC)
replies: text: The PHP code requires some fixes. Calling session_regenerate_id() after session_destroy() is useless, the session is already destroeyed, hency session_id() returns an empty string. Calling session_start() immediately after session_destroy() has almost the same effect, it generates a new session id. 14:43, 01 January 2009 (UTC)
thread_title:  [[Wikibooks:Programming:PHP/sessions#Avoiding_Session_Fixation|PHP Wikibook on Sessions]] 

message: What exactly does this mean:
"However, session identifiers are often accepted from GET/POST as well on these standard systems."
I am trying to improve the grammar but I occasionally need to know what the author means. Please help. --Glubbdrubb (talk) 15:15, 20 January 2009 (UTC)
thread_title:  Clarification 

message: Could anyone explain why we are looking for this in $_SERVER['HTTP_REFERER'] in example in section "Defense in Depth"? It's possibly good idea to explain it in the actual article as well. Sadi (talk) 22:45, 2 March 2009 (UTC)
thread_title:  https://DiD/ ? 

message: Would it be a valid countermeasure to store client's IP in the cookie when the cookie is created, and on subsequent requests check that the client's IP matches the IP stored in the cookie?
No. If only it worked, but there are too many cases where the IP address can change.  See below. 21:53, 13 March 2015 (UTC)
thread_title:  Client IP in cookie? 

message: "A simple workaround to this, but by no means robust, is to carry out a 'loose' IP check whereby you can check the first three out of the four numbers within the IPv4 Address."
This is worthless. Whoever wrote this needs to read up on CIDR. They also need to read up on IPv4 address notation. An IP is just a number and can be represented many different ways. Even the dot notation has many different valid forms. For example: A.B.C.D and A.E can represent the same IP if E is a 24 bit number representing B.C.D.  —Preceding unsigned comment added by 173.178.6.171 (talk) 16:31, 5 April 2011 (UTC)
thread_title:  'loose' IP check?