Thanks guys, I see now. That is a good feature. Eric <div class="gmail_quote">On Tue, Mar 4, 2008 at 10:14 AM, Stephen De Gabrielle <<a href="mailto:stephen@degabrielle.name">stephen@degabrielle.name</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Hi, I think I have this right; It's a feature because you can bookmark it or send the url to a friend and share it. <div class="Ih2E3d"> > I feel like this makes it easy to hijack a user's session, am I wrong? </div>how you secure a session to an individual user is seperate; - a unique url is sometimes used in low security applications. (eg google calendar lets you create an UNindexed url for your private calendar - anyone who has the url can see your calendar) - cookies are a simple easy and method that is often used to maintain a session. cookies access is granted by you browser to websites with the same domain name;  web applications at <a href="http://www.google.com" target="_blank">www.google.com</a> can 'see' only  cookies created by web pages at <a href="http://www.google.com" target="_blank">www.google.com</a> (or <a href="http://subdomain.www.google.com" target="_blank">subdomain.www.google.com</a> etc.) - ssl is (or should be) used for the login phase when a greater level of security is desired. BTW I think you use send/finish for single use url's Cheers, Stephen<div><div></div><div class="Wj3C7c"> <div class="gmail_quote"> On Tue, Mar 4, 2008 at 2:50 PM, Jay McCarthy <<a href="mailto:jay.mccarthy@gmail.com" target="_blank">jay.mccarthy@gmail.com</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> This is what should happen. There is no way to change the behavior that if "X" runs when you go to URL "Y" from computer "A", then it will also happen from computer "B". So, It is easy to hijack a user's session if you don't prepare for it. For example, you can make the "X" that happens rely on the computer being "A", through a cookie, for example or by requiring an HTTP password on the url (that will be cached and transparent to a client who has already logged in.) Jay btw, We consider this a feature. <div><div></div><div> On Tue, Mar 4, 2008 at 6:27 AM, Eric Biunno <<a href="mailto:01rice@gmail.com" target="_blank">01rice@gmail.com</a>> wrote: > In v371, > when I connect to a servlet from one client computer and receive a > continuation embedded into URL, > I can then invoke this continuation from another client computer without a > problem. > Is this what should happen? Does the development version behave the same > way? Is there a way to change this behavior? >  Am I not understanding the proper use of web-server continuations? > I feel like this makes it easy to hijack a user's session, am I wrong? > > Thanks, > Eric > </div></div>> _________________________________________________ >   For list-related administrative tasks: >   <a href="http://list.cs.brown.edu/mailman/listinfo/plt-scheme" target="_blank">http://list.cs.brown.edu/mailman/listinfo/plt-scheme</a> > > -- Jay McCarthy <<a href="mailto:jay.mccarthy@gmail.com" target="_blank">jay.mccarthy@gmail.com</a>> <a href="http://jay.teammccarthy.org" target="_blank">http://jay.teammccarthy.org</a> _________________________________________________  For list-related administrative tasks:  <a href="http://list.cs.brown.edu/mailman/listinfo/plt-scheme" target="_blank">http://list.cs.brown.edu/mailman/listinfo/plt-scheme</a> </blockquote></div> -- </div></div>Cheers, Stephen -- Stephen De Gabrielle <a href="mailto:s.degabrielle@ucl.ac.uk" target="_blank">s.degabrielle@ucl.ac.uk</a> Telephone +44 (0)20 7679 5242 (x45242) Mobile                  079 851 890 45 Project: Making Sense of Information (MaSI) <a href="http://www.uclic.ucl.ac.uk/annb/MaSI.html" target="_blank">http://www.uclic.ucl.ac.uk/annb/MaSI.html</a> UCLIC: University College London Interaction Centre <a href="http://www.uclic.ucl.ac.uk/" target="_blank">http://www.uclic.ucl.ac.uk/</a> Remax House - 31/32 Alfred Place London - WC1E 7DP </blockquote></div>