Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I was reading about XSS and I found out that checking IP and user-agent is a good way to prevent cookie stealing. I tested that on SO and I found out SO doesn’t log out people after changing their IP or user-agent but when I copied ALL headers and send them to SO using another program, it sent me out. How it can detect that something is different when IP and user agent are not important and all http headers are the same?
SE for example uses a more way auth. SE saves a token like a cookie as a offline data on a subdomain and sends that to the server where the data are verified on some way. Than you get a temporal token that is send to the login Site and you will been logged in.
I hope that helps.