Re: We need another Auth

le 10/06/02 10:54, Nicolas Hoizey à nhoizey@php.net a écrit : > Hi Bertrand, > >> I don't understand why there is a session_start() in the class >> start() method. This will start a new session everytime htdig >> accesses a new page. > > It starts a new session because the first one it creates is not given > to the following requests. > > ht://Dig doesn't accept cookies, so the session ID should be put in > the URL. I know that. But this starts to make a lot of exceptions that were not planned in Auth. I corrected the problem by doing a test for the cookie before calling start(). But I can only test for PHPSESSID. What if my cookie variable has a different name. This should be set and accessible in the Auth class. I don't have to know what my Auth cookie name is, especially if I work with other developers on the same project. Auth should be able to tell me all this. I found an interesting pdf about 'Session ID Brute Force Exploitation'. It can be found here : http://www.idefense.com/idpapers/SessionIDs.pdf >> I don't see why the session should start if the user didn't bother >> authenticating. > > You can need sessions even if you don't need authentication, they are > usefull for that, but not only. Thanks for the tip... You understand the opposite of what I am saying. I am saying that if someone is not authenticated, I don't want the Auth script to trigger session_start(). There is no reason for that. He is just not authenticated and that's all, I don't need to start a new session to know that, do I ? Of course, you might need sessions for doing something else, in which case you will trigger session_start two times thanks to Auth. I don't know about the overhead it causes but some more classes like that and I bet you can't figure out anymore when and where your session started and for what reason. Bertrand Mansion Mamasam