In theory they can. Because HTTP is stateless, the username and password have to be supplied again for each request. Users don't see this because the browser handles it for them. In practice they can't, because most (all?) browsers don't give the user an easy way to change their username and password once they have successfully logged in to your site, but some might, and if they are using their own program or talking raw HTTP at your server or something similar then all bets are off.
Even so, if the user *can* send some other username/password, that username/password would still have to be accepted by your web server before they could get at any content so it's probably not something you need to worry about. | [reply] |
