Re: Re[2]: [PEAR] session cross between users?

Well, I'm using Auth to validate users in my application. The solution that says Justin means that every time I have a cross session now forces a logout in the application? Is it , this is not the solution I need. I want that the user don't have a cross session and continue with his session. Another matter is that my php session timeout is too small. I'm thinking change the Auth mechanism to a LiveUser autentication system. Do you reccomend it? My problems can disappear if I use LiveUser and not Auth? Thanks > On Thu, 18 Nov 2004 21:02:21 -0000, subs <subs@snackfood.org> wrote: >> >> >> > On Thu, 18 Nov 2004 14:04:32 -0500, Erik Heerlein >> > <erik@erikheerlein.com> wrote: >> > > That IP validation may be a problem if the user is on a AOL >> > account as >> > > an AOL users IP can change on the fly. >> > > >> > >> > Are you absolutely sure of that? Dial-up users' IPs can >> > change between dial-ups, but I doubt they're going to change >> > on-the-fly. If they did, the internet simply wouldn't work. >> > >> > Unless, of course, they're using some kind of round-robin >> > proxy system, but usually a user gets directed to one and >> > stays there for the entire session. >> > >> >> Some proxy clusters will often present a number of different addresses >> to a >> remote server during a session. Any authentication/authorization >> mechanism >> which relies on REMOTE_ADDR is generally a bad idea IMHO. >> You could add a user_id field to your sessions table and do the >> equivalent >> of "DELETE FROM sessions WHERE user_id = <user_id> AND session_id != >> <new_session_id>" after each successful login (assuming you're using a >> DB >> session store). Shouldn't be too hard to hook this in somewhere. >> > > Yeah, but the point is that the session is being hijacked. If this is > the case, it's almost certain that the user has the same session > cookie/id, so this wouldn't help. > > -- > Justin Patrin > > -- > PEAR General Mailing List (http://pear.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > >