|
If you're not using Ajax, that's a real bummer. Ajax gotten pretty simple with JQuery. If you have followed the conversation, you could pipe the data into session then send it after login, but that would be open to abuse - in the case that a malicious or even unknowing user uses the same computer as the last user who had unsaved PMs - this is because you'd have to use client-side cookies which are open to abuse, editing and such. If you have random Session IDs stored in them for validation, that will at least protect the app from Remote Users( Who don't do cookie stealing). In short, that's a feature - if you don't use Ajax draft Saving - that will introduce an unnecessary security hole that may come to bite you up ahead.
|