i have a lot of projects that i would like to distribute, but only if i knew they were secure. i have been reading online for some time, and just mainly want to share and get info with you all on this topic. i read some other posts relating to the topic, but none of them seemed to really hit the spot…
[B]my scenario
[list=1][*]
if not logged (session variable) enter username and password
data is checked for injection and fails if found
passwords are checked with them being one-way encrypted in db
username is stored in session variable
user navigates thoughout my site
session is destroyed upon logout or browser exit
i guess i am just curious as to if i have any security holes in there?
if the session wasn’t deleted, it would be stored on the server. so if someone got the session_id, then they could replace the generated one with the one that holds all of the previously logged users information. mainly the variable that held true that they were logged in, right?