Re: Inadvertant Session Hijacking

> Now this is not the malicious kind where a user intentionally takes over > another session. I'm speaking of a case where the random session ID > generator happens to give another user someone else's session whether active > or inactive (inactive and not yet cleared by garbage collection). > > I had a case just this weekend where this happened, a user got another > visitor's shopping cart. The potential is for someone to get another > person's logged in session. The site I work with gets 5,000 unique visitors > a day, it's a very very busy website and I'm thinking that garbage > collection isn't up to snuff or that the random ID generation isn't quite > random enough. > > What can I do about this? I have increased the percentage of garbage > collection already, what else can I do? Use session_id() to create your own session ids before you call session_start(). Make them 64 characters instead of 32 using two calls to uniqid(). That would make it less likely that someone gets assigned the same ID, wouldn't it? ---John Holmes...