RE: Re[2]: [PEAR] session cross between users?

> On Thu, 18 Nov 2004 14:04:32 -0500, Erik Heerlein > <erik@erikheerlein.com> wrote: > > That IP validation may be a problem if the user is on a AOL > account as > > an AOL users IP can change on the fly. > > > > Are you absolutely sure of that? Dial-up users' IPs can > change between dial-ups, but I doubt they're going to change > on-the-fly. If they did, the internet simply wouldn't work. > > Unless, of course, they're using some kind of round-robin > proxy system, but usually a user gets directed to one and > stays there for the entire session. > Some proxy clusters will often present a number of different addresses to a remote server during a session. Any authentication/authorization mechanism which relies on REMOTE_ADDR is generally a bad idea IMHO. You could add a user_id field to your sessions table and do the equivalent of "DELETE FROM sessions WHERE user_id = <user_id> AND session_id != <new_session_id>" after each successful login (assuming you're using a DB session store). Shouldn't be too hard to hook this in somewhere. Ben