Tickets :: Comment on [#9438] authentication fails via syncml

* Your Email Address
* Spam protection	Enter the letters below: . .\ /.__ . .. . \|\ \| >< [__)\| \|\|_/ \| \\|/ \[__)\|/\\|\| \
Comment	> Jan, > > We still need the change to _checkAuthentication(). The reason for > it is in the patch I sent, but basically the Horde authentication > backend creates a new session id upon successful authentication. > This is standard good practice to avoid "session fixation", but > unfortunately SyncML relies on session fixation, because the client > specifies the session id, and the server has no way to request a new > id. > > So, you have to store the session id before authentication and reset > it after, unless you want to update the authentication backend to add > a parameter to suppress session regeneration. > > -- Logan
Attachment
Watch this ticket