Re: Security hole using cookies for sessions. Workaround?
| From: | Andy | Date: | Fri, 29 Mar 2002 20:36:06 +0000 |
| Subject: | Re: Security hole using cookies for sessions. Workaround? | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-90714@lists.php.net to get a copy of this message | ||
hmm.. but there must be some other way to do this. I know one site which is
handling this problem.
check out http://www.web.de
Andy
"Rasmus Lerdorf" <rasmus@lerdorf.ca> schrieb im Newsbeitrag
news:Pine.LNX.4.44.0203291108100.5613-100000@christine.ca...
> > My question is:
> > Is there a way to close this hole and let the session expire as soon as
only
> > the active window
> > is closed?
>
> Nope, that's how browsers work. Your only real way to fix it would be to
> expire a session after a certain amount of inactivity. That's what the
> PHP sessions do by default - 24 minutes of inactivity and the session data
> is expired.
>
> There is no way to detect a user closing one window of a browser session.
>
> -Rasmus
>