From: Thomas Fini Hansen <beast@...>
Date: 2004-05-12T20:24:19+09:00
Subject: Re: [OT] Web, Cookies and Sessions

On Wed, May 12, 2004 at 10:52:12AM +0900, Dmitry V. Sabanin wrote:
> On Wednesday 12 May 2004 03:03, Eric Schwartz wrote:
> > "Kirk Haines" <khaines@enigo.com> writes:
> > > I don't think there's any magic other than trying to deliver a cookie
> > > when they first arrive at your site and then seeing if it's there on the
> > > next transaction.
> >
> > You can get a bit sneaky, if you're willing to trust your users a
> > little.  OTOH, if you're using cookies, you're *already* trusting the
> > user to not be malicious, at least a bit.  The algorithm looks like:
> >
> > On any page load:
> > 1) Check if there's a cookie.  If so, all is well, exit.
> > 2) Check if HTTP_REFERER (note spelling) comes from the same site.
> >    If not, then set a cookie.
> This is it! :-)
> As I said, I overlooked the obvious thing. Thank you very much!

You can't trust HTTP_REFERER either, some 'security software' diables
them, in Opera it's just F12->Enable referrer logging, and then there
seems to be the odd people that got a static referrer... How that
messes with the above is left as an exercise for the reader. ;)

I'd go with the belt and braces approach. On the first hit, set the
cookie *and* use URL session. On the next hits, drop the URL encoding
if you get the cookie.

-- 
Thomas
beast@system-tnt.dk