I still don't see how this prohibits sessions from being used by another browser. Maybe there is something obvious that I am missing. arhuman, can you please clarify this for me?

What information is used in the hash?

If the information in the hash is not directly tied to the browser (such as IP address, browser name), I don't see how a server can determine if the "incorrect" browser is requesting the session.

If only the session key and some private value is used in the hash, how does the server determine if the hashed value came from the browser that it was originally sent to or some other browser?

In reply to Re: Re: Re: Re: Re: The sound of one cookie (not) authenticating by sutch
in thread The sound of one cookie (not) authenticating by Hero Zzyzzx

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.