RE: CSS, CSS & let me give you some more CSS

From: info@elitesoft.org
Date: 02/01/02 

From: <info@elitesoft.org>
Date: Fri, 1 Feb 2002 11:08:59 -0500
To: Obscure <obscure@eyeonsecurity.net>

If you use IP address for session cookie attacker can't use
stolen cookie.
However, you can't use IP address when BGP or Proxy are used.
In this case the best protection is to change session cookie
for each transaction using transaction counter.
This will provide a transaction non-repudiation.
If such session cookie is stolen and used by a hacker prior
to a user, then user session will be blown away.

Mike