Re: Session IP address matching

On Sat, Jan 25, 2014 at 4:21 AM, Andrea Faulds <ajf@ajf.me> wrote: > > > On 25/01/14 01:11, Andrey Andreev wrote: >> >> Yes, one can write a custom session handler, but there's a number of >> problems with that: > > > Correct me if I'm wrong, but why would you need to do that? Surely, this > would suffice: > > if (!isset($_SESSION['ip'])) { > $_SESSION['ip'] = $_SERVER['REMOTE_ADDR']; > } else if ($_SERVER['REMOTE_ADDR'] !== $_SESSION['ip']) { > session_destroy(); > } > - I don't want the IP stored in session data, I already know it. - filemtime() result of the potentially targeted session id is changed, extending its expiry time - multiple set-cookie headers Basically, I want it to be perfect. :)