Cookiless Session Is it a security risk?
- by Costa
Hi
http://msdn.microsoft.com/en-us/library/aa479314.aspx
You have a user who successfully log in from a machine in Cybercafe, Hacker H able to sniff the network and get the sessionID of the user, Can H use the sessionId and act as the user from another machine?
Can H enter http://folder/(session id)/CreditCardInformation.aspx to know the credit card number of the user?