Re: Are there really multi processes in FCGI::Perl?
Tim Wood <timwood0-yBeKhBN/[email protected]>
| Newsgroups | gmane.comp.web.fastcgi.devel |
|---|---|
| Message-ID | <5.2.1.1.1.20050418102841.021e9de0@mailhost> |
At 10:58 AM 04/18/05, you wrote: >Thank you Bryan, > >I think I've got your answer. Would be proper way (I mean efficient and safe >enough) if the cookie will be this "back chanell" and all user dependent >variables will be in hash indexed by cookie ID? Make sure to use a highly random ID, otherwise the user could troll for someone else's state. Use https to prevent state hijacking. Moreover, you've got a basic problem if the FCGIs hold on to any state specific to an transaction, unless that state is reestablished (not recopied, but re-searched for) with each invocation. A securely generated cookie will do it. Don't forget to invalidate the cookie when you're done, but the server side still has to handle bad cookies. HTH, TW ___________________________________ fastcgi-developers mailing list http://fastcgi.com/fastcgi-developers/