Re: Security hole using cookies for sessions. Workaround?
| From: | Rasmus Lerdorf | Date: | Fri, 29 Mar 2002 19:09:16 +0000 |
| Subject: | Re: Security hole using cookies for sessions. Workaround? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-90702@lists.php.net to get a copy of this message | ||
> My question is:
> Is there a way to close this hole and let the session expire as soon as only
> the active window
> is closed?
Nope, that's how browsers work. Your only real way to fix it would be to
expire a session after a certain amount of inactivity. That's what the
PHP sessions do by default - 24 minutes of inactivity and the session data
is expired.
There is no way to detect a user closing one window of a browser session.
-Rasmus