[Phplib-users] session stealing and fallback_mode=get

[Giancarlo P. <gia...@na...>]

You all probably know that anyone can be forced to an hijackable session
just by offering him to click on a link like
http://whatever.com/whatever.php3?Example_Session=friendsonly
??
This case shows cookies to be a secure choice.
I am sure there's something wrong in the code, because even if 'get' is
the intended mode as a 'fallback', here we not only force the session,
but the mode too.

I think that if 'cookie' is set and cookies are on, it should definitely
use them. While it seems to be driven into the fallback mode when the
session is present in the URL.

I am afraid this is a fault, and should be fixed. 
It should be stressed that mode=get should be disabled for security and
by default, and use only in restricted environment

Giancarlo