New answers tagged session-fixation
Is SSL/TSL and HttpOnly enough to be sure that a session cannot be hijacked? Those are the must dos, and they offer good (but not perfect) protection. See question four. Is there a way to use client IP addresses as an extra layer of protection? Just checking that a session ID is used by the IP that created it will break your site for a lot of users, ...
Top 50 recent answers are included