note 74183 deleted from ref.session by danbrown

Note Submitter: gordon_e_rouse at yahoo dot com dot au ---- Multi-site security risk! Suppose you use session security to determine login status, and you have several such sites on the webserver which essentially assign a session token to determine your login status. A common occurence for webdeveloping companies that have a standard system or package, and are not using a high security setup. (ie all sites share the same session path directory) PHP sends the browser a cookie and that cookie should only be valid for the site it was retrieved from, but only the browser determines this, the server does not record the path or domain with the session cookie, so technically you could modify the browsers cookie jar to send the same cookie request for a different domain or path than what was originally meant. This means that if the same session variables are used to determine a logon status on different sites on this server, then the user can access all these sites with the one session id. The solution is to write the domain and or path as session variables as well, thus when logged on status is checked, the script checks that the session was created through the current domain or path.