note 48960 deleted from function.session-cache-limiter by didou

Note Submitter: Nicola ---- I was using the default PHP session setup for a simple site where users log in and can do simple things. All was OK ... until the traffic started to grow and then we got a lot of reports from users saying that their identify was randomly and constantly changing as they walked through the pages! After much headaching, my conclusion was that with the standard PHP session cookie headers, the AOL proxy farm is caching the pages *including* the cookie. So the AOL proxy farm might serve to user B the cookie which was originally sent to user A; and then user B suddenly has the authentication credentials of user A if you're using a simple cookie-based authentication. This is a *massive* problem. Just think of the implications -- a user logs into his account and is randomly sent to another account. When he clicks on a button to do something *pop* he's sent to yet another account. So I added session_cache_limiter ('private'); before every instance of session_start (); If you have AOL users and you are using cookie-based sessions, you will probably have to do this. I'm still testing that the fix is working fine. I'm surprised nobody mentioned this before though.