[NeilFawcett]

Originally Posted by filburt1

a. That timeout is configurable. The default is 20 minutes, but it can be anything the administrator specifies.
b. A referer can be faked.
c. An IP address is not a sufficient means of authenticating, especially only the first three octets which can be used for a pool of DHCP addresses.

What I'm after here is a reasonably realistic way of using the registration system of VBB to authenticate users, not a system that would be used by the CIA

The above three suggestions used in combination would mean that someone could potentially get their session id, and give it to someone else, but it would only work if they did so within 20 minutes, and the other person was in their local area. But in general it's pretty tight? It would also mean they were risking the other person going into their VBB account itself!

Can you maybe suggest what might work, rather than what won't?

Am I right in saying that if someone has cookies enabled then the session id is held in cookies? As such could I only include the session id in my link from VBB to my software if cookies are disabled?


So my software would first of all interrogate cookies for the session id, and then failing that look for it in the URL. This would make it even more secure?


Any suggestions/help would be most appreciated...