Session security

[ximian]

Hi all.

On most web applications, session validation is (and should) always be checked against some properties like: client_ip, client_useragent and idletimeout.

What do you think to add these check properties to DooSession? This way, developer do not need to worry about session hijack.

Btw, a encryption option (and the correspondent encryption key option in DooSession) to encrypt all data could be an excellent addon too.

best regards
Francisco A

[leng]

It isn't necessary if you are talking about the use of session. If you meant session for authentication stuffs, yea it's very important. This is actually handle in DooAuth if you're using this class as a part of your authentication solution.