note 39049 deleted from function.session-regenerate-id by nlopess
| From: | nlopess@php.net | Date: | Tue, 10 Feb 2004 18:31:18 +0000 |
| Subject: | note 39049 deleted from function.session-regenerate-id by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-64974@lists.php.net to get a copy of this message | ||
Note Submitter: gmirchev@usa.net
----
Use this code to stop session fixation attack (the most effective session attack). PHP is
perimissive and will accept fixated cookies unless you make sure it won't. Just call this
function AFTER successful login.
<?php
function new_session()
{
session_name('PHPSESSION');
unset($_COOKIE['PHPSESSION']); # Stop session fixation
session_start();
}
?>