note 8187 added to Session handling functions
| From: | dinky at pmail dot net | Date: | Wed, 30 Aug 2000 14:25:02 +0000 |
| Subject: | note 8187 added to Session handling functions | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-3668@lists.php.net to get a copy of this message | ||
> This means that a user can takeover the session of another user if he
> knows (or guesses) the other user's session id. (all web applications are
> vulnerable to this attack).
While it is true that you can take over other users' session ID's, there are
several things you can do to prevent this from happening.
One way is to store the remote user's IP address on the server.
When you start a new session, do this:
$ipaddr = $REMOTE_ADDR;
session_register("ipaddr");
And when the user requests a document with sensitive data
verify his/her IP address:
if($ipaddr != $REMOTE_ADDR) {
echo "Go away!\n";
exit;
}
http://www.php.net/manual/ref.session.php