Hi everyone,
Just had a talk with tech about this. As you are aware, if a session ID is posted anywhere and the user is online (meaning the session is still active), you will be logged into the other user's account.
Obviously, this is not desirable. We will be switching to Cookie sessions in the near future to do away with this problem, as we certainly want to make sure our system is as secure as possible.
Again, thank you for bringing this to our attention. Tech's working on the solution right now.
Kind regards,
Brad
brad.tilley@sedo.com