Re: Confusion on HTML visibility

On Fri, 4 Jan 2008 10:14:25 +0000 Toby A Inkster said
Sig wrote:

You overlooked what I said about the session variable. Perhaps I should
have mentioned that the session variable is set under password control
on a previous page.

No, I did not. The session variable is simply a cookie as far as my
browser is concerned.

If I've acquired this cookie -- and we can assume that I have, given that
I've seen the image via an <img> tag (that's the entire premise of this
thread) -- then my browser can (and by default will!) send the cookie when
making a direct request for the image.

OK, I now see that our disagreement is philosophical rather than technical. If
we hold the world constant (including session variables) you are correct. If we
want a way to hide an image from unauthorized viewers, then I am correct.

I don't say I solved the OP's problem, he did say

To put
it another way, is there a method to allow an HTML script in the document
root to see and image (or file or whatever) and still prevent access to
that resource?

I think my approach does that. He said nothing about holding the world
constant, and I assumed it was unauthorized viewers he wanted to prevent.

--
http://koiclubsandiego.org/comment/?r=8
.

Relevant Pages

  • Re: FYI: Losing session variables, authentication, cookies
    ... session variables would never get ... Turns out it was because of an underscore character in the domain, ... When you use a cookie-based session, the server send a cookie to the ... The browser does not accept cookies if a host name contains the ...
    (microsoft.public.dotnet.framework.aspnet)
  • Problem with Firefox/Mozilla and Cookies.
    ... Mozilla or Firefox. ... values in this cookie to retrieve the user_id, ... Logs on to my site, surf around, and without closing the window ... log in again, but I loose all the cookies and session variables, ...
    (comp.lang.php)
  • Re: Common Login page across multiple web applications on the same domain
    ... At the suggestion of a friend I did the following: ... session variables and if they are not there, I retrieve the cookie and ... > Is there any way to use a common login page across multiple web ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: This doesnt "set" a cookie to expire - why?
    ... Evertjan. ... Server-side cookie destruction is handled but I believe not very ... Then it is much easier and safer to use session variables. ...
    (comp.lang.javascript)
  • Re: Problem with SESSION variables...
    ... ZoombyWoof wrote: ... I have problems with session variables, ... > variables to maintain their value between different php script that is ... Check the session cookie on page 2 with session_get_cookie_params.. ...
    (comp.lang.php)
Loading