sarath wrote:
The PHPSESSID is displayed in my MediaWiki site. How
secure is it to
have PHPSESSID displayed? If it can be disabled what is the best way to
do it? Thanks
This is a PHP sessions option; I'd recommend turning it off, as session
IDs could be taken from the referer information passed by the browser
when the user clicks on an external link.
I believe the option to turn off is session.use_trans_sid. You can do
this in php.ini, possibly in an .htaccess, or with the ini_set()
function in your LocalSettings.php.
http://www.php.net/session
http://www.php.net/ini_set
-- brion vibber (brion @
pobox.com)