[Zope-Coders] Re: [Zope-Checkins] CVS: Zope/lib/python/Products/Sessions/stresstests - stresstestMultiThread.py:1.5

[Shane Hathaway]

Florent Guillaume wrote:
> Chris McDonough  <chrism@zope.com> wrote:
> 
>>Added the capability for browser ids to be encoded in URLs.
> (snip) 
> 
> This is a quite useful feature, but at the same time a very dangerous
> one security-wise.

Before Zope, I once implemented sessions using URLs.  Over time, I 
discovered many more problems than I expected.  I could list them, but 
instead I'll just say that cookie-based sessions are really the only One 
True Way. :-)

Shane