Re: session_regenerate_id()
| From: | Alexander Mueller | Date: | Wed, 29 Oct 2003 18:02:44 +0000 |
| Subject: | Re: session_regenerate_id() | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-168025@lists.php.net to get a copy of this message | ||
"Cpt John W. Holmes" wrote:
>
> PHP 4.3.2 created a new session ID, but it didn't resend the cookie. So the
> next request would include the old session ID again from the cookie.
I wonder what it is then good for. Changing the id internally without
notifying the client does not make much sense IMHO.
>
> What are you trying to do?
Changing the session id upon a login to prevent referal attacks.
Alexander
--
PINO - The free Chatsystem!
Available at http://www.pino.org