Re: session cross between users?

You could use a "fingerprint". Create an md5'ed hash of a string made up of a secret passphrase and the browser's user-agent string. This isn't a perfect solution but it might solve part of the problem. Something like this... // if they are spoofing who they are if (md5($CFG['secretcode]' . $_SERVER['HTTP_USER_AGENT']) != $_SESSION['fingerprint']) { // perform logout sequence } have you tried doing a reverse DNS lookup on the ip addresses and seeing if you could use that information to keep the session from being hijacked. Perhaps a gethostbyaddr call added to my fingerprint code could get a little closer to what you want. one of the problems that I see with my fingerprint idea is that IE is so prevalent that it's quite possible for the user-agent to be identical between several users. plus, user-agent is so easy to spoof. matte leo@calidae.net wrote:

Well, I'm using Auth to validate users in my application. The solution that says Justin means that every time I have a cross session now forces a logout in the application? Is it , this is not the solution I need. I want that the user don't have a cross session and continue with his session. Another matter is that my php session timeout is too small. I'm thinking change the Auth mechanism to a LiveUser autentication system. Do you reccomend it? My problems can disappear if I use LiveUser and not Auth? Thanks

On Thu, 18 Nov 2004 21:02:21 -0000, subs <subs@snackfood.org> wrote:

On Thu, 18 Nov 2004 14:04:32 -0500, Erik Heerlein <erik@erikheerlein.com> wrote:

That IP validation may be a problem if the user is on a AOL

account as

an AOL users IP can change on the fly.

Are you absolutely sure of that? Dial-up users' IPs can change between dial-ups, but I doubt they're going to change on-the-fly. If they did, the internet simply wouldn't work. Unless, of course, they're using some kind of round-robin proxy system, but usually a user gets directed to one and stays there for the entire session.

Some proxy clusters will often present a number of different addresses to a remote server during a session. Any authentication/authorization mechanism which relies on REMOTE_ADDR is generally a bad idea IMHO. You could add a user_id field to your sessions table and do the equivalent of "DELETE FROM sessions WHERE user_id = <user_id> AND session_id != <new_session_id>" after each successful login (assuming you're using a DB session store). Shouldn't be too hard to hook this in somewhere.

Yeah, but the point is that the session is being hijacked. If this is the case, it's almost certain that the user has the same session cookie/id, so this wouldn't help. -- Justin Patrin -- PEAR General Mailing List (http://pear.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php