in reply to Re^2: Is this a secure way to prevent cookie tampering
in thread Is this a secure way to prevent cookie tampering

The "session_secret" isn't buying you a thing. Think about the attack vectors. If someone has the session_id, they also have the session_secret, since they got it by sniffing. If someone can guess your session_id, you didn't use a strong enough ID. Just put more bits into one value: no need to separate it into two values.

Simplify your life. Just use a session_id. That's enough.

-- Randal L. Schwartz, Perl hacker
Be sure to read my standard disclaimer if this is a reply.

  • Comment on •Re^3: Is this a secure way to prevent cookie tampering

In Section Seekers of Perl Wisdom