note 90641 deleted from ref.session by aidan

Note Submitter: info at ede dot ec Reason: 2 ---- I am using session.use_trans_sid=1 and session.use_cookies=0 for a Web site and I ran into a problem where expired and deleted session IDs could be reused and allowed for session hijacking. For example, if Google picks up a link with a session ID on your site, the same session could be used over and over again when visitors are entering through that link from Google. This creates a problem if you have many users entering at the same time as they would share session stored variables. Very dangerous! After a couple of days banging my head against the wall, I finally managed to solve the problem by checking if a session exists in the "tmp" folder *before* session_start(). If a session is called that does not exist in the "tmp" folder, I simply force PHP to reload the page without the session ID, hence creating a new ID. <?php if(($_GET[PHPSESSID])&&(!is_file("/tmp/sess_$_GET[PHPSESSID]"))){ $url_spl=split("\&PHPSESSID",$_SERVER[REQUEST_URI]); header("Location: $url_spl[0]"); exit; } session_start(); //rest of the script... ?>