note 84423 added to function.session-start

@ash Whilst this may prevent session hijacking attempts, it also ruins the user experience, pressing back and forward will result in the 'security' token being out of sync. Also opening new tabs/ windows will also cause issues. A better method would be to simply check the ip address or ip block of the user. But this is not without problems either. To access highly sensitive information, the user should be required to enter his/her password again, even tho they are logged in. This ensures that session hijackers can not access this information. All this goes hand-in-hand with regenerating session ids on login, and good use of https. ---- Server IP: 203.88.112.190 Probable Submitter: 219.90.196.119 ---- Manual Page -- http://www.php.net/manual/en/function.session-start.php Edit -- https://master.php.net/note/edit/84423 Del: integrated -- https://master.php.net/note/delete/84423/integrated Del: useless -- https://master.php.net/note/delete/84423/useless Del: bad code -- https://master.php.net/note/delete/84423/bad+code Del: spam -- https://master.php.net/note/delete/84423/spam Del: non-english -- https://master.php.net/note/delete/84423/non-english Del: in docs -- https://master.php.net/note/delete/84423/in+docs Del: other reasons-- https://master.php.net/note/delete/84423 Reject -- https://master.php.net/note/reject/84423 Search -- https://master.php.net/manage/user-notes.php