note 43944 deleted from ref.session by nlopess
| From: | nlopess@php.net | Date: | Fri, 09 Jul 2004 14:44:24 +0000 |
| Subject: | note 43944 deleted from ref.session by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-72924@lists.php.net to get a copy of this message | ||
Note Submitter: chris@schaake.nu
----
This is a small code to prevent sessions from being hijacked. It works with most proxy servers
(tested with squid).
<?
// Setup or restore a session
session_start();
// Check if the session is resumed by the correct user
if (! isset($_SESSION['ip_address'])) { // This is a new session
if ($_SERVER['HTTP_X_FORWARDED_FOR']) { // Check if user is coming via a proxy (not 100%
safe)
$_SESSION['ip_address'] = $_SERVER['HTTP_X_FORWARDED_FOR'];
} else {
$_SESSION['ip_address'] = $_SERVER['REMOTE_HOST'];
}
} else { // This is a resumed session, so check the ip-address stored with the session
if (($_SESSION['ip_address'] != $_SERVER['HTTP_X_FORWARDED_FOR']) AND
($_SESSION['ip_address'] != $_SERVER['REMOTE_HOST'])) {
echo "Session is hijacked";
exit;
}
}
?>