Re: How to protect against cookie stealing?

[Chris Green <cmg () sourcefire com>]

".:[ Death Star]:." <deathstar () optonline net> writes:
> There is another solution, you can use both sessionID's and cookies, so
> based on the IP address you would look for the cookie before giving the
> user access control. The session ID will store 2 fields (example userid
> and associated ip address) the cookie will hold other fields. And u can
> use multiple sessions and multiple cookies that will be destroyed upon
> opening another page.

Has anyone going down this route of incorporating an IP address into
the cookie gotten pushback from people on networks with multiple
proxies or routing rules?
-- 
Chris Green <cmg () sourcefire com>
Don't use a big word where a diminutive one will suffice.