Instead the issue is that customers can mistakenly give away a link into their session just by giving the current URL to someone else.

Ok I may have missed the question, it thought it was What's the best way to avoid Joe Blow having access to the original shoppers cart?.


I don't understand how computing a hash will prohibit sessions from being transferred with URLs

The hash use is only to one way to secure a parameter (verbatim from my post)
A parameter hashed this way can't be used in another session nor faked.


Is the server or the browser going to compute the hash?

The server, beccause only the server knows the 'private value'...


If the server, then the URL is usable by any browser (which means that it can be given to others along with the hashed session ID)

As the hash value is bound to an id session you just can't use it with another session !
So you can't reuse and old hash value nor even compute it (if you know your id session) to feed it to the server as you don't know the private value...

"Only Bad Coders Badly Code In Perl" (OBC2IP)

In reply to Re: Re: Re: Re: The sound of one cookie (not) authenticating by arhuman
in thread The sound of one cookie (not) authenticating by Hero Zzyzzx

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.