Re: Persistent state applications
| From: | Eric Butera | Date: | Sat, 17 May 2008 20:28:06 +0000 |
| Subject: | Re: Persistent state applications | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-274474@lists.php.net to get a copy of this message | ||
On Sat, May 17, 2008 at 4:22 PM, James Colannino <james@colannino.org> wrote:
> I'm assuming that a session will last as long as the browser is open (or
> until it's explicitly destroyed), correct? Are there any security issues I
> should be aware of? Since there's a login, I'd be serving this over SSL,
> and the user's password would be stored as an SHA1 hash in the MySQL db.
Sessions last as long as they are configured for. You can see these
values in the php.ini
http://php.net/manual/en/session.configuration.php
Security concerns:
http://talks.php.net/show/phpworks2004-php-session-security