 session id abuse  From: Johnny GoLightly
(mywebquestionyahoo.com.au) Date: Fri Feb 13 2004 - 06:20:09 CST
Hi all,  I have some quesitons regarding session id's.  Consider
the following scenario:  User requires access to a web
application for a long period of time with inactivity. Therefore
assume that sessionID never expires.  Session information stored
on web server (or application server) says that this user has
read-only access to the information shown on the page which is
extracted from a database.  The application auto refreshes the
page on the browser every 15 minutes with updated info that
other users may have entered in the preceding period.  Is it
possible for:  1. Another user to change the session information
on the server and change access from read only to write (by
knowing the session id)?  2. Knowing the session id (perhaps
from info on the URL) can one create another session from
another browser using the same session ID?  3. How can you
effectively limit concurrent access to only 1 session?