Re: Auth module security flaw?

le 28/01/02 19:08, Marius Andreiana à mandreiana_lists@yahoo.com a écrit : > On Lu, 2002-01-28 at 19:48, Martin Jansen wrote: >> On 28 Jan 2002 19:45:20 +0200, Marius Andreiana wrote: >> >>> I see it registers the session variable "auth", but I don't know how >>> will it work in case you have several applications on the save >>> server (each with a different auth). >> >> PEAR Auth uses PHP's built-in session support. So the session >> will be only valid for the current (virtual) host. > yes, but we don't have virtual hosts for every application, > current system uses sub-directories for them. > like www.x.org/app1, www.x.org/app2 ... I don't see where the problem is, then. Just define your session cookie for the whole domain and store your session data (variables...) in a database shared by the different applications. Each of them will find auth value in this db, at the row corresponding to your session id. Bertrand Mansion Mamasam