note 8493 added to Session handling functions
| From: | ori at chikki dot net | Date: | Thu, 14 Sep 2000 01:05:00 +0000 |
| Subject: | note 8493 added to Session handling functions | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-4928@lists.php.net to get a copy of this message | ||
is there a way to stop session hijacking?
If a user is authenticated using a session, there is nothing stopping in finding the session id,
appending it to the URL in a new browser and taking over their session.
I tried using the REMOTE_ADDR field, but some ISP POST form variables from a different IP to GET
requests and, users using a proxy are prone to error.
Any ideas would be great.
http://www.php.net/manual/ref.session.php