note 76832 added to function.session-destroy
| From: | administrator at anorhack dot com | Date: | Wed, 01 Aug 2007 14:34:46 +0000 |
| Subject: | note 76832 added to function.session-destroy | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-129103@lists.php.net to get a copy of this message | ||
Destroying a session from a background job
I have a thief-protection system that compares country codes from login IPs via whois. This has to
run in the background as it is way too processor-hungry to be run in the browser.
What I needed was a way to destroy the web session from the background job. For some reason, a
background session_destroy APPEARS to work, but doesnt't actually destroy the web session.
There is a work around, I set the username to NULL and the web code picks up on that, bouncing the
user (thief) to a "gotcha" page where his IP is logged.
Yes I know its nasty and dirty, but surprisingly it works.
$sid = the session_id() of the suspicious web session, passed in $argv to the background job
The trick is to "stuff" the $_GET array with the sid, then the session_start in the
background job picks this value up (as if it were a genuine trans-sid type thing...?PHPSESSID=blah)
and "connects to" the web session. All $_SESSION variable can be viewed (and CHANGED ,
which is how this kludge works) but for some reason (that no doubt someone will illuminate) they
can't be unset...setting the particular variable to NULL works well though:
$_GET[session_name()]=$sid;
session_start();
// prove we are getting the web session data
foreach($_SESSION as $k => $v) echo($k."=".$v);
// now kill the thief
$_SESSION['username']=NULL;
//web session variable now NULL - honestly!
----
Server IP: 194.145.210.3
Probable Submitter: 81.156.118.149
----
Manual Page -- http://www.php.net/manual/en/function.session-destroy.php
Edit -- https://master.php.net/note/edit/76832
Del: integrated -- https://master.php.net/note/delete/76832/integrated
Del: useless -- https://master.php.net/note/delete/76832/useless
Del: bad code -- https://master.php.net/note/delete/76832/bad+code
Del: spam -- https://master.php.net/note/delete/76832/spam
Del: non-english -- https://master.php.net/note/delete/76832/non-english
Del: in docs -- https://master.php.net/note/delete/76832/in+docs
Del: other reasons-- https://master.php.net/note/delete/76832
Reject -- https://master.php.net/note/reject/76832
Search -- https://master.php.net/manage/user-notes.php