MIDRANGE dot COM Mailing List Archive



Home » MIDRANGE-L » February 2005

RE: How to keep persistant data between web apps



fixed

Assign a session ID that is completely random and never re-used.  Store it
in a file with the necessary information to identify the current signed on
customer.  Even if they see it, it means nothing to them or any one else.
When they logoff, delete the record and have an activity time stamp that can
be used to expire the record and purge them on a regular basis.

Chris Bipes

-----Original Message-----

I had originally thought about that.  But my concern is that someone will 
look at the HTML source and see the hidden field and then be able to modify 
information.  My site will be used for my distributors to have access to 
their data.  open order, net price, etc.  I do not want someone to be able 
to change the customer number in the hidden field and then replacing the 
variables on the address bar and access a different customers information. 
I would hope this would not happen.  But If I have thought of it then 
someone else has also.

I just want to protect my customers/distributors.

I might go this route to initially get the site running until I can find an 
alternate solution

Scott Swaim





Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2014 by MIDRANGE dot COM and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available here. If you have questions about this, please contact