note 66675 added to ref.session

If you have a value specified for session.referer_check you may run into difficulty when someone accesses your site and attempts to log in with a mis-capitalized URL. The logon will fail because any calls to session_start() will result in the existing session being trashed and a new one being created. This becomes a bigger problem when the logon is followed by a header("Location: ...") redirect, because the session_start() at the top of the page will fail. Because session_start() always returns true, it's not obvious how to detect when the referer check fails. To detect it, I have come up with a method which compares the intended session id with the session id after session_start() is run. If they are different, the user is redirected to the proper location. This example uses a technique to avoid session id fixation, as well. ini_set('session.referer_check', 'www.yourdomain.edu/ltr/'); ini_set('session.use_only_cookies', 1); session_name('yourapp'.str_replace('.', '', $_SERVER['REMOTE_ADDR'])); session_start(); if($_GET['badreferer']) echo 'You tried accessing the site with a bad URL. Try logging on again.'; if(isUserAuthed($name, $pass)) { $old_sessid = session_id(); //save current session id so we can delete it later if( !session_regenerate_id() ) //get a new session id (must do this before destroying the old session) die("Couldn't regenerate your session id."); $new_sessid = session_id(); //save new session id so we can get back to it session_id($old_sessid); unset($old_sessid); session_destroy(); //destroy the session they got before they logged in session_id($new_sessid); session_start(); //start the new session $_SESSION = array(); //not really necessary any more, but still a good idea if(session_id() != $new_sessid) { /*If this is true, then the session_start() failed to work properly. If session_start() failed to work properly, the most likely cause is that the referer url is different from that set in fuxebox.ini on session.referer_check. The most common cause of this is URL capitalization problems. Therefore, we relocate them to the proper URL, and set a flag to display an error because we can't use pushError() if the session isn't valid. */ $good_url = ini_get('session.referer_check'); header('Location: http://'.$good_url.'?badreferer=1'); exit; } else { unset($new_sessid); //Set session variables here $_SESSION['isloggedin'] = 1; echo 'You have been logged in.'; } } ---- Server IP: 216.194.113.175 Probable Submitter: 138.87.210.52 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/ref.session.php Edit -- http://master.php.net/note/edit/66675 Del: integrated -- http://master.php.net/note/delete/66675/integrated Del: useless -- http://master.php.net/note/delete/66675/useless Del: bad code -- http://master.php.net/note/delete/66675/bad+code Del: spam -- http://master.php.net/note/delete/66675/spam Del: non-english -- http://master.php.net/note/delete/66675/non-english Del: in docs -- http://master.php.net/note/delete/66675/in+docs Del: other reasons-- http://master.php.net/note/delete/66675 Reject -- http://master.php.net/note/reject/66675 Search -- http://master.php.net/manage/user-notes.php