[Zope-Coders] Re: [Zope-Checkins] CVS: Zope/lib/python/Products/Sessions/stresstests - stresstestMultiThread.py:1.5

[Chris McDonough]

> The problem is that now any an external site that's linked from a site
> using this feature will receive as a Referer all your session
> information. I know that sessions aren't supposed to be used for
> authentication, but I'm not sure everyone will comply, and also in the
> case of anonymous users you're doomed.

Right.

> This kind of bug was prevalent in a huge number of webmail applications
> until recently: you only had to send a mail to someone with in it a link
> to a site whose logs you could read, and voil=E0, you had their full
> authentication (because they were stored as session in the URL).

Right.

I'm hoping that the reward outweighs the risk...=20

There is an obligatory security warning in the sessioning chapter of the
new edition of the Zope Book
http://www.zope.org/Documentation/Books/ZopeBook/2_6Edition/Sessions.stx
.  It needs to be expanded and modified... thanks for pointing out the
referrer issue, I would not have thought of it.

- C