note 126566 added to function.session-start
| From: | polygon dot co dot in at gmail dot com | Date: | Sun, 07 Nov 2021 10:01:35 +0000 |
| Subject: | note 126566 added to function.session-start | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-217155@lists.php.net to get a copy of this message | ||
Websites are prone to Session Attack where its proper usage is not done.
There are tools like "Apache Benchmark" (ab) and many others which can hit the website
with load for load / performance testing.
Code below starts the session for every request.
<?php
session_start();
$username = $_POST['username'];
$password = $_POST['password'];
if(isValidUser($username, $password)) {
Suserdetails = getUserDetails($username);
$_SESSION['user_id'] = Suserdetails['user_id'];
$_SESSION['username'] = Suserdetails['username'];
$_SESSION['firstname'] = Suserdetails['firstname'];
header('Location: dashboard.php');
}
?>
This generates session file for every request irrespective of PHPSESSID cookie value when I use
tools like ab, there by creating inode issue.
One should start the session after properly authenticating.
<?php
$username = $_POST['username'];
$password = $_POST['password'];
if(isValidUser($username, $password)) {
Suserdetails = getUserDetails($username);
session_start();
$_SESSION['user_id'] = Suserdetails['user_id'];
$_SESSION['username'] = Suserdetails['username'];
$_SESSION['firstname'] = Suserdetails['firstname'];
header('Location: dashboard.php');
}
?>
Scripts other then login first validates session which requires session.
<?php
if(session_status()!=PHP_SESSION_NONE) header('Location: login.php');
session_start();
if(!isset($_SESSION['user_id'])) header('Location: login.php');
code logic below....
}
?>
This example is for file based session.
For other modes of session check function session_set_save_handler.
----
Server IP: 45.112.84.4
Probable Submitter: 45.112.85.242 (proxied: 103.58.153.70)
----
Manual Page -- https://php.net/manual/en/function.session-start.php
Edit -- https://main.php.net/note/edit/126566
Del: integrated -- https://main.php.net/note/delete/126566/integrated
Del: useless -- https://main.php.net/note/delete/126566/useless
Del: bad code -- https://main.php.net/note/delete/126566/bad+code
Del: spam -- https://main.php.net/note/delete/126566/spam
Del: non-english -- https://main.php.net/note/delete/126566/non-english
Del: in docs -- https://main.php.net/note/delete/126566/in+docs
Del: other reasons-- https://main.php.net/note/delete/126566
Reject -- https://main.php.net/note/reject/126566
Search -- https://main.php.net/manage/user-notes.php