note 39049 added to function.session-regenerate-id
| From: | gmirchev at usa dot net | Date: | Thu, 15 Jan 2004 13:42:37 +0000 |
| Subject: | note 39049 added to function.session-regenerate-id | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-63607@lists.php.net to get a copy of this message | ||
Use this code to stop session fixation attack (the most effective session attack). PHP is
perimissive and will accept fixated cookies unless you make sure it won't. Just call this
function AFTER successful login.
<?php
function new_session()
{
session_name('PHPSESSION');
unset($_COOKIE['PHPSESSION']); # Stop session fixation
session_start();
}
?>
----
Manual Page -- http://www.php.net/manual/en/function.session-regenerate-id.php
Edit -- http://master.php.net/manage/user-notes.php?action=edit+39049
Delete -- http://master.php.net/manage/user-notes.php?action=delete+39049&report=yes
Reject -- http://master.php.net/manage/user-notes.php?action=reject+39049&report=yes
Search -- http://master.php.net/manage/user-notes.php