Re: Re[2]: [PEAR] session cross between users?

On Thu, 18 Nov 2004 21:02:21 -0000, subs <subs@snackfood.org> wrote: > > > > On Thu, 18 Nov 2004 14:04:32 -0500, Erik Heerlein > > <erik@erikheerlein.com> wrote: > > > That IP validation may be a problem if the user is on a AOL > > account as > > > an AOL users IP can change on the fly. > > > > > > > Are you absolutely sure of that? Dial-up users' IPs can > > change between dial-ups, but I doubt they're going to change > > on-the-fly. If they did, the internet simply wouldn't work. > > > > Unless, of course, they're using some kind of round-robin > > proxy system, but usually a user gets directed to one and > > stays there for the entire session. > > > > Some proxy clusters will often present a number of different addresses to a > remote server during a session. Any authentication/authorization mechanism > which relies on REMOTE_ADDR is generally a bad idea IMHO. > You could add a user_id field to your sessions table and do the equivalent > of "DELETE FROM sessions WHERE user_id = <user_id> AND session_id != > <new_session_id>" after each successful login (assuming you're using a DB > session store). Shouldn't be too hard to hook this in somewhere. > Yeah, but the point is that the session is being hijacked. If this is the case, it's almost certain that the user has the same session cookie/id, so this wouldn't help. -- Justin Patrin