RE: (clarification) GET and POST Methods Accepted

["Derick Anderson" <danderson () vikus com>]

> -----Original Message-----
> From: Andrew van der Stock [mailto:vanderaj () greebo net] 
> Sent: Friday, October 14, 2005 12:51 PM
> To: Amit Klein (AKsecurity)
> Cc: webappsec () securityfocus com
> Subject: Re: (clarification) GET and POST Methods Accepted
[...]
> Many frameworks (PHP and many J2EE implementations included) 
> use "transparent" relocation of the cookie to GET, and 
> coupled with GET state and poor authorization, replay is 
> possible with poor quality apps.

This extremely irritating behavior can be stopped in PHP by setting a
php.ini variable ("use_only_cookies" if memory serves). However it is
only available since PHP version 4.3.0, again if memory serves.

Derick Anderson