note 43944 added to ref.session

This is a small code to prevent sessions from being hijacked. It works with most proxy servers (tested with squid). <? // Setup or restore a session session_start(); // Check if the session is resumed by the correct user if (! isset($_SESSION['ip_address'])) { // This is a new session if ($_SERVER['HTTP_X_FORWARDED_FOR']) { // Check if user is coming via a proxy (not 100% safe) $_SESSION['ip_address'] = $_SERVER['HTTP_X_FORWARDED_FOR']; } else { $_SESSION['ip_address'] = $_SERVER['REMOTE_HOST']; } } else { // This is a resumed session, so check the ip-address stored with the session if (($_SESSION['ip_address'] != $_SERVER['HTTP_X_FORWARDED_FOR']) AND ($_SESSION['ip_address'] != $_SERVER['REMOTE_HOST'])) { echo "Session is hijacked"; exit; } } ?> ---- Manual Page -- http://www.php.net/manual/en/ref.session.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+43944 Delete -- http://master.php.net/manage/user-notes.php?action=delete+43944&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+43944&report=yes Search -- http://master.php.net/manage/user-notes.php