RE: CSS, CSS & let me give you some more CSS

[<info () elitesoft org>]

If you use IP address for session cookie attacker can't use 
stolen cookie.
However, you can't use IP address when BGP or Proxy are used.
In this case the best protection is to change session cookie 
for each transaction using transaction counter.
This will provide a transaction non-repudiation.
If such session cookie is stolen and used by a hacker prior 
to a user, then user session will be blown away.

Mike