[NeilFawcett]

Originally Posted by filburt1

A session ID is not a suitable means of authenticating somebody. A link with a session ID can be copied and pasted to some other site, and when users click the link, your script will think that they're authenticated.

a) Surely a session ID is only valid for X minutes or so? ie: When I go to the forum, it recognises my logon and assigns me a sessions ID. When I stop using the forum, the session record will surely be deleted within X minutes? Therefore if I try and use my suggested link after these X minutes, the session record wouldn't even exist and authentication in my script would not be valid (as it wouldn't find a session record)?

b) My script would ensure the request came from my site; The REFERER (referrer) would have to be my site. ie: Someone not could post a link on another site (as you suggest), and loads of people click it within the X minutes.

c) I could even take one step further and validate say the first 3 elements of the IP address - if that's what is held in "location" on that session table?

Surely this is a fairly good means of me piggy-backing of the VBB authentication system?