RE: [PHP] Session stealing, ..
| From: | Jennifer Goodie | Date: | Fri, 12 Sep 2003 22:36:53 +0000 |
| Subject: | RE: [PHP] Session stealing, .. | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-162477@lists.php.net to get a copy of this message | ||
> 93 # When deserialized we are called and need to check if the
> stored IP address equals the client's
> 94 function __wakeup() {
> 95 global $Log;
> 96 if ($_SERVER['REMOTE_ADDR'] !=
> $this->Night['IP']) {
> 97 $Log->Warning('IP Address changed during
> sleep and wakeup, will clear userdata');
> 98 $this->Data = Array();
> 99 };
> 100 }
>
> Upon sleep it stores the IP and time in the session data, and
> when it smells
> coffee my object wakes up, checks if he's still being used on the
> same host
> and if not the userdata is plainly cleared.
>
I hope none of your site visitors are on AOL as the IP can change between
page requests for AOL users.