Been Gone Way Too Long

This message was sent from: Development
http://forums.oscommerce.com/viewtopic.php?p=164479#164479
----------------------------------------------------------------

Hi Folks,

I really appreciate all the hard work everybody has done on this session problem.  

Last time I was on the forum was when this thread was just getting started, about 18 pages ago. 

Once upon a  time I intended to help in the fashion Ross and Marcel have been doing, but I ended up becoming preoccupied with setting up a dedicated server and migrating my customers to it.   I've spent tons of time on tuning DNS, weighing the differences between Ensim,CPanel, and Plesk,  learning all the nuances of the one I picked,  writing a business plan, writing a new website totally from scratch, writing backup/restore  scripts, writing a recurring billing program, dealing with domain registrar gateways, etc. etc etc etc ad nauseum.  Dedicated servers are really a lot of work, but very fascinating. Finally I am around to installing new carts.  

I have now upgraded to MS1 and anxiously await MS2 which will have all the session fixes integrated, correct?

Or would it be advisable to just get the cvs instead?   Are the proposed fixes checked into  the cvs code? I do  quite a bit of customization so I dont want to have to upgrade very often.

One request:  

Can MS2 be made to easily tune the session to timeout within some "merchant  defined timelimit" ( such as 20 minutes ), then erase as much of the the contents of the cookie as possible if not indeed the entire cookie?  

Why do I ask?
Because this way if an unscrupulous website or host does get the cookie  off the customer's browser  he will have only 20  minutes (or less) to  hijack a session.  If he doesnt do it within  that window  then his chances of hijacking are reduced to the same probability as that of an SID  collision  when using the URL based SID's under the old Oct release, ie,  he will have to wait for the SID number generator in the cart to roll over.