RE: [PHP] Destroy Sessions

I think that is just the downfall of using sessions. Though it's far from fool-proof, you could check the $HTTP_REFERER variable to make sure they accessed an internal page from another internal page. That would keep them from bookmarking an internal page and revisiting it later. Though this variable can be spoofed, I think for your situation, it's not a concern. Jason > > Well I have that already. When a person first logs in a session variable > with the current time is set. Every page resets this variable. > So on every > page I check to see if the current time - session time is greater than 10 > minutes. Without clicking on pages, the time session variable doesn't get > reset, so in effect they get kicked out after 10 minutes of idleness. > > However, that leaves a 10 minute window. They could bookmark the page. > Close the window (browser). Open within 10 minutes, and it will > work fine. > > The exact problem you mention. > > Any other thoughts? > > > ----- Original Message ----- > From: "Jason" <jasonc@webpipe.net> > Newsgroups: php.general > Sent: Wednesday, July 26, 2000 12:58 PM > Subject: RE: [PHP] Destroy Sessions > > > Seems to me you could use a timestamp or an expiration to destroy the > cookie. While this wouldn't prevent someone from closing the > page and then > re-opening it immediately, it might do the trick. > > Jason > > > > > > Hello, > > > > I am encountering a problem with sessions and them lingering around. > > > > Basically, a user logs in and they can see certain pages based on their > > access level. There is a logout button also that runs the > > session_destroy() > > function. If the user presses logout, there are no problems. > However, if > > the user bookmarks the internal pages and then closes the > browser without > > clicking logout, that session still lingers. When they reopen > the browser > > and use their bookmark, the internal pages work! > > > > If I look at the directory where the sessions are stored, I can see the > > session file created when the person logs in. If they click > logout (hence > > session_destroy()) the file gets deleted. However, if the user > > just closes > > the window, the session file remains, which allows the use of the > > bookmark. > > > > I am passing PHPSESSID via GET also in case people don't use cookies. > > > > Why isn't the session file getting deleted when a user closes > the browser? > > How do I do this? > > > > Rohan :-) > > > > > > > > -- > > PHP General Mailing List (http://www.php.net/) > > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > > For additional commands, e-mail: php-general-help@lists.php.net > > To contact the list administrators, e-mail: php-list-admin@lists.php.net > > > > > > > _______________________________________________________ > Site Design, Hosting, and E-Commerce at www.webpipe.net > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net > > > _______________________________________________________ Site Design, Hosting, and E-Commerce at www.webpipe.net