note 66675 modified in ref.session by danbrown

If you have a value specified for session.referer_check you may run into difficulty when someone accesses your site and attempts to log in with a mis-capitalized URL. The logon will fail because any calls to session_start() will result in the existing session being trashed and a new one being created. This becomes a bigger problem when the logon is followed by a header("Location: ...") redirect, because the session_start() at the top of the page will fail. Because session_start() always returns true, it's not obvious how to detect when the referer check fails. To detect it, I have come up with a method which compares the intended session id with the session id after session_start() is run. If they are different, the user is redirected to the proper location. This example uses a technique to avoid session id fixation, as well. <?php ini_set('session.referer_check', 'www.yourdomain.edu/ltr/'); ini_set('session.use_only_cookies', 1); session_name('yourapp'.str_replace('.', '', $_SERVER['REMOTE_ADDR'])); session_start(); if($_GET['badreferer']) echo 'You tried accessing the site with a bad URL. Try logging on again.'; if(isUserAuthed($name, $pass)) { $old_sessid = session_id(); //save current session id so we can delete it later if( !session_regenerate_id() ) //get a new session id (must do this before destroying the old session) die("Couldn't regenerate your session id."); $new_sessid = session_id(); //save new session id so we can get back to it session_id($old_sessid); unset($old_sessid); session_destroy(); //destroy the session they got before they logged in session_id($new_sessid); session_start(); //start the new session $_SESSION = array(); //not really necessary any more, but still a good idea if(session_id() != $new_sessid) { /*If this is true, then the session_start() failed to work properly. If session_start() failed to work properly, the most likely cause is that the referer url is different from that set in fuxebox.ini on session.referer_check. The most common cause of this is URL capitalization problems. Therefore, we relocate them to the proper URL, and set a flag to display an error because we can't use pushError() if the session isn't valid. */ $good_url = ini_get('session.referer_check'); header('Location: http://'.$good_url.'?badreferer=1'); exit; } else { unset($new_sessid); //Set session variables here $_SESSION['isloggedin'] = 1; echo 'You have been logged in.'; } } ?> --was-- If you have a value specified for session.referer_check you may run into difficulty when someone accesses your site and attempts to log in with a mis-capitalized URL. The logon will fail because any calls to session_start() will result in the existing session being trashed and a new one being created. This becomes a bigger problem when the logon is followed by a header("Location: ...") redirect, because the session_start() at the top of the page will fail. Because session_start() always returns true, it's not obvious how to detect when the referer check fails. To detect it, I have come up with a method which compares the intended session id with the session id after session_start() is run. If they are different, the user is redirected to the proper location. This example uses a technique to avoid session id fixation, as well. ini_set('session.referer_check', 'www.yourdomain.edu/ltr/'); ini_set('session.use_only_cookies', 1); session_name('yourapp'.str_replace('.', '', $_SERVER['REMOTE_ADDR'])); session_start(); if($_GET['badreferer']) echo 'You tried accessing the site with a bad URL. Try logging on again.'; if(isUserAuthed($name, $pass)) { $old_sessid = session_id(); //save current session id so we can delete it later if( !session_regenerate_id() ) //get a new session id (must do this before destroying the old session) die("Couldn't regenerate your session id."); $new_sessid = session_id(); //save new session id so we can get back to it session_id($old_sessid); unset($old_sessid); session_destroy(); //destroy the session they got before they logged in session_id($new_sessid); session_start(); //start the new session $_SESSION = array(); //not really necessary any more, but still a good idea if(session_id() != $new_sessid) { /*If this is true, then the session_start() failed to work properly. If session_start() failed to work properly, the most likely cause is that the referer url is different from that set in fuxebox.ini on session.referer_check. The most common cause of this is URL capitalization problems. Therefore, we relocate them to the proper URL, and set a flag to display an error because we can't use pushError() if the session isn't valid. */ $good_url = ini_get('session.referer_check'); header('Location: http://'.$good_url.'?badreferer=1'); exit; } else { unset($new_sessid); //Set session variables here $_SESSION['isloggedin'] = 1; echo 'You have been logged in.'; } } http://php.net/manual/en/ref.session.php