Re: [php-gtk-webmaster] cvs: php-gtk-web / admin-logout.php

Whatever... it still needs to be a different cookie.

What do you mean by 'signed'? do we have a secure server setup?


> What i'm saying is that using username as the name of the cookie is  
> not a good idea. We should have a generic cookie named "BOO" that  
> stores both username and password. And by the way, all cookies like  
> that should be signed.
> 
> -Andrei
> 
> 
> On Jul 9, 2006, at 9:32 AM, Steph Fox wrote:
> 
>> I didn't want to do that because of the encoding on the initial  
>> cookie...  I think you should look at when they're actually used  
>> before jumping on me. One's storing settings (and doesn't get  
>> deleted at the end of a session), one's storing user/pass (and does  
>> get deleted at the end of a session), and the only time the third  
>> one's used at all is if there's a test environment set up.
>>
>> Thanks for all the faith!
>>
>>
>>> I think we should not pollute cookie namespace with multiple  
>>> cookies.  The way to do it is to have one cookie (PHP-GTK, for  
>>> example) that  contains multiple key=value pairs, like:
>>>
>>> setcookie('PHP_GTK', 'foo=bar&boo=baz');
>>>
>>> Then you can use parse_str() to parse it.
>>>
>>> -Andrei
>>>
>>>
>>> On Jul 9, 2006, at 9:24 AM, Steph Fox wrote:
>>>
>>>> $_COOKIE['username']=>'emailofchoice'. I should probably make the  
>>>> timeout shorter, it's only intended for testing (so people can  
>>>> find their way around without wrecking the live db).
>>>>
>>>>> What kind of cookie would this set?
>>>>>
>>>>> -Andrei
>>>>>
>>>>>
>>>>> On Jul 9, 2006, at 1:44 AM, Steph Fox wrote:
>>>>>
>>>>>> +setcookie($user = get_user(), '', time() - (3600*24), '/');
>>>>>
>>>>> -- 
>>>>> PHP-GTK Webmaster Mailing List (http://gtk.php.net/)
>>>>> To unsubscribe, visit: http://www.php.net/unsub.php
>>>>>
>>>>>
>>>>> __________ NOD32 1.1380 (20060125) Information __________
>>>>>
>>>>> This message was checked by NOD32 antivirus system.
>>>>> http://www.eset.com
>>>>>
>>>
>>> -- 
>>> PHP-GTK Webmaster Mailing List (http://gtk.php.net/)
>>> To unsubscribe, visit: http://www.php.net/unsub.php
>>>
>>>
>>> __________ NOD32 1.1380 (20060125) Information __________
>>>
>>> This message was checked by NOD32 antivirus system.
>>> http://www.eset.com
>>>
> 
> 
> __________ NOD32 1.1380 (20060125) Information __________
> 
> This message was checked by NOD32 antivirus system.
> http://www.eset.com
> 
>