[Zope-Coders] Re: [Zope-Checkins] CVS: Zope/lib/python/Products/Sessions/stresstests - stresstestMultiThread.py:1.5

[Martijn Pieters]

On Wed, Aug 21, 2002 at 10:36:56AM -0400, Chris McDonough wrote:
>       The moral of the story is: if you're going to use sessions to store
>       sensitive information, and you link to external sites within your
>       own site, you're best off using *only* cookie-based browser ids.

I now understand why the webmail portion of Communigate shows a seperate
page that redirects to the actual URL when you click on a URL in an email.
The URL of that page does noet contain any session identifying information.
Maybe this could be mentioned? 'or use a gateway page for external URLs that
does noet include a browser ID'.

-- 
Martijn Pieters
| Software Engineer  mailto:mj@zope.com
| Zope Corporation   http://www.zope.com/
| Creators of Zope   http://www.zope.org/
---------------------------------------------