RE: [PHP] Inadvertant Session Hijacking

You can generate your own session ids, you could use a randomly assign it or use part of the ip address in conjunction with a randomly generated key (something like appending the last 3 digits of the visiting IP address to a randomly generated session key). You could keep track of them in a database as well and check to see if it is already in use before assigning it to the user, but this would generate additional load on your database server. Jason Sheets -----Original Message----- From: Thomas Deliduka [mailto:thomas@xenocast.com] Sent: Monday, October 21, 2002 9:15 AM To: php-general@lists.php.net Subject: [PHP] Inadvertant Session Hijacking Now this is not the malicious kind where a user intentionally takes over another session. I'm speaking of a case where the random session ID generator happens to give another user someone else's session whether active or inactive (inactive and not yet cleared by garbage collection). I had a case just this weekend where this happened, a user got another visitor's shopping cart. The potential is for someone to get another person's logged in session. The site I work with gets 5,000 unique visitors a day, it's a very very busy website and I'm thinking that garbage collection isn't up to snuff or that the random ID generation isn't quite random enough. What can I do about this? I have increased the percentage of garbage collection already, what else can I do? -- Thomas Deliduka IT Manager ------------------------- Xenocast Street Smart Media Solutions http://www.xenocast.com/ -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php