note 39770 added to function.session-regenerate-id
| From: | dizit at mail dot ru | Date: | Tue, 10 Feb 2004 10:19:35 +0000 |
| Subject: | note 39770 added to function.session-regenerate-id | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-64938@lists.php.net to get a copy of this message | ||
>>gmirchev at usa dot net
For preventing session fixation attack you must unset possible variable not only in $_COOKIE.
Session id may be passed including via GET, POST, requests.
There is a need to unset session ID in $_COOKIE, $_GET, $_POST
----
Manual Page -- http://www.php.net/manual/en/function.session-regenerate-id.php
Edit -- http://master.php.net/manage/user-notes.php?action=edit+39770
Delete -- http://master.php.net/manage/user-notes.php?action=delete+39770&report=yes
Reject -- http://master.php.net/manage/user-notes.php?action=reject+39770&report=yes
Search -- http://master.php.net/manage/user-notes.php