Hi,
How easy is it to spoof a user when using sessions? The user ID of the logged in user is stored in a session (so I don't have to keep polling the database). Can this be retrieved by the user, or is it well hidden since it's based server side?
Also, I'm currently checking if a user can access a particular record in a table, by using a permission table. The SQL command compares the userID, of the currently logged in user via the session, and the record ID they wish to access. It then checks whether this combination has permission or not. However, is it possible for a user to change the session to store another user's ID which does have permission for the record and then access the record?
I hope the questions are clear
Thanks!
...
Go to the complete details ...