How Easy Is It to Hijack Session Vars on GoDaddy (PHP)
- by yar
This article states that
If your site is run on a shared Web
server, be aware that any session
variables can easily be viewed by any
other users on the same server.
On a larger host like GoDaddy, are there really no protections in place against this? Could it really be that easy? If it is that easy, where are the session vars of the other users on my host so I can check them out?
Edit: I didn't believe it, but here's my little program which shows that this is true! I wonder if those are really the same as the value stored in the cookies on the users' machine?