note 90641 added to ref.session

I am using session.use_trans_sid=1 and session.use_cookies=0 for a Web site and I ran into a problem where expired and deleted session IDs could be reused and allowed for session hijacking. For example, if Google picks up a link with a session ID on your site, the same session could be used over and over again when visitors are entering through that link from Google. This creates a problem if you have many users entering at the same time as they would share session stored variables. Very dangerous! After a couple of days banging my head against the wall, I finally managed to solve the problem by checking if a session exists in the "tmp" folder *before* session_start(). If a session is called that does not exist in the "tmp" folder, I simply force PHP to reload the page without the session ID, hence creating a new ID. <?php if(($_GET[PHPSESSID])&&(!is_file("/tmp/sess_$_GET[PHPSESSID]"))){ $url_spl=split("\&PHPSESSID",$_SERVER[REQUEST_URI]); header("Location: $url_spl[0]"); exit; } session_start(); //rest of the script... ?> ---- Server IP: 69.147.83.197 Probable Submitter: 190.155.213.215 ---- Manual Page -- http://www.php.net/manual/en/ref.session.php Edit -- https://master.php.net/note/edit/90641 Del: integrated -- https://master.php.net/note/delete/90641/integrated Del: useless -- https://master.php.net/note/delete/90641/useless Del: bad code -- https://master.php.net/note/delete/90641/bad+code Del: spam -- https://master.php.net/note/delete/90641/spam Del: non-english -- https://master.php.net/note/delete/90641/non-english Del: in docs -- https://master.php.net/note/delete/90641/in+docs Del: other reasons-- https://master.php.net/note/delete/90641 Reject -- https://master.php.net/note/reject/90641 Search -- https://master.php.net/manage/user-notes.php