Re: why does PHP accept [new] session ids from client?
| From: | Stefan Esser | Date: | Thu, 31 Mar 2005 17:49:42 +0000 |
| Subject: | Re: why does PHP accept [new] session ids from client? | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-15705@lists.php.net to get a copy of this message | ||
Hi Hans,
common case of session use, though. I wonder if this could be a behavior controlled by a php.ini setting in the future? I guess what Iwell there actually is a way to switch off this behaviour. You can disable any kind of session fixation attack by adding the line php_admin_flag engine off in your httpd.conf So long Stefan ps: If you find any kind of irony in my post, you can keep it...