Re: Re: LiveUser externalValues?

roehr@zilleon.com wrote: >> Hi, >> >> I just wonder what is the use of LiveUser::setExternalValues() and >> LiveUser::externalValuesMatch() ? >> >> I can not understand from the doc comments. >> >> Thanks. >> >> Regards, >> Matthias > > Hi Matthias, > > this is a way to hinder/complicate session hijacking. You can define any kind of values like > the user's ip address, user agent, charset whatever. This will be stored in the session on > successful login and then validated with the current values on each page request. When the values > that were stored on login do not match with the current values, the user will be denied access. > > You can define it in the config for the auth container like this: > 'externalValues' => array('values' => $_SERVER, // any kind of array > 'keysToCheck' => array('HTTP_USER_AGENT')) // > keys existent in the array from above > > This means the user agent will be compared to the value in $_SERVER on each page request after > the login. > > You don't need to rely on $_SERVER, you can also use values of your own. > Ahh, thanks for making this clear to me. :-) Sounds like a useful feature. Regards, Matthias