Re: Session Management and IP address - experiences?

[Viktors Rotanovs <Viktors () Rotanovs com>]

Thomas Schreiber wrote:

> A question about their experiences to those people that are running web
> applications with the clients ip address bound to the session.

From my experience, binding session to first two octets of IP address 
is safe, and adding HttpOnly to session cookie solves a problem when bad 
javascripts steal session cookies.
For more info about HttpOnly:
http://msdn.microsoft.com/workshop/author/dhtml/httponly_cookies.asp
AFAIK HttpOnly is supported in MSIE, Mozilla/Firefox and Konqueror (and 
probably others).
I've also written HttpOnly patch for PHP4:
http://rotanovs.com/php-session-httponly.patch
To enable HttpOnly support, apply this patch and add this string to your 
php.ini:
session.cookie_httponly = 1

Best Wishes,
Viktors