note 78653 rejected from function.session-regenerate-id by james
| From: | james@php.net | Date: | Mon, 22 Oct 2007 05:13:58 +0000 |
| Subject: | note 78653 rejected from function.session-regenerate-id by james | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-131618@lists.php.net to get a copy of this message | ||
Note Submitter: Kyle
----
I can't really figure this out, maybe someone can help.
<?php
session_start();
session_regenerate_id(true);
if (isset($_SESSION['data'])) {
$session = $_SESSION['data'];
} else {
$session = '';
$_SESSION['data'] = $_GET['data'];
session_write_close();
}
echo "Session: $session";
?>
Load the page with "?data=foo" to set some data. Then delete the query string and load the
page again. Now start refreshing the page, perhaps just hold down F5 and let it go. Eventually your
session data will be lost.
I thought that maybe it was to do with writing the file too slowly on the server, but it seems much
more likely to be the user's browser writing the cookie too slowly.
You would think that the user would never access a page fast enough for this to be a problem, but
with XmlHttpRequests going off quickly, it can and does happen.
Unless I'm wrong, I don't think that setting the delete_old_session parameter to true is a
good idea. Just encrypt your session data and let the garbage collection take care of things.