Re: post to bugtraq about "session fixation"

From: Cesar <cesarc56(at)yahoo.com>
Date: Fri Dec 20 2002 - 11:00:19 EST

You are right. It is an interesting and well written paper.
But there is a wrong statement in paper, Microsoft Internet Information Server is NOT "Strict", is a kind of "Permissive" it will accept some proposed cookie SessionID and i will create a new session.

Cesar.

• "Steven M. Christey" <coley@linus.mitre.org> wrote:
  >
  > securityarchitect@hush.com said:
  

  ---

Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com Received on Fri Dec 20 11:02:31 2002