Re: Re[2]: [PEAR] session cross between users?

On Thu, 18 Nov 2004 23:09:25 +0100 (CET), leo@calidae.net <leo@calidae.net> wrote: > Well, I'm using Auth to validate users in my application. > The solution that says Justin means that every time I have a cross session > now forces a logout in the application? It should be possible to not force a logout, but I couldn't find it quickly. If you do some more research on creating a new session you should be able to do it. You could also use PEAR's HTTP_Session. > Is it , this is not the solution I > need. I want that the user don't have a cross session and continue with > his session. Another matter is that my php session timeout is too small. So turn it up. It's a setting in the php.ini. > I'm thinking change the Auth mechanism to a LiveUser autentication system. > Do you reccomend it? My problems can disappear if I use LiveUser and not > Auth? No idea, sorry. If the problem is with the PHP session handler, changing to a different system is unlikely to help. Are you using the normal file-based PHP sessions or DB sessions? > > Thanks > > > > > On Thu, 18 Nov 2004 21:02:21 -0000, subs <subs@snackfood.org> wrote: > >> > >> > >> > On Thu, 18 Nov 2004 14:04:32 -0500, Erik Heerlein > >> > <erik@erikheerlein.com> wrote: > >> > > That IP validation may be a problem if the user is on a AOL > >> > account as > >> > > an AOL users IP can change on the fly. > >> > > > >> > > >> > Are you absolutely sure of that? Dial-up users' IPs can > >> > change between dial-ups, but I doubt they're going to change > >> > on-the-fly. If they did, the internet simply wouldn't work. > >> > > >> > Unless, of course, they're using some kind of round-robin > >> > proxy system, but usually a user gets directed to one and > >> > stays there for the entire session. > >> > > >> > >> Some proxy clusters will often present a number of different addresses > >> to a > >> remote server during a session. Any authentication/authorization > >> mechanism > >> which relies on REMOTE_ADDR is generally a bad idea IMHO. > >> You could add a user_id field to your sessions table and do the > >> equivalent > >> of "DELETE FROM sessions WHERE user_id = <user_id> AND session_id != > >> <new_session_id>" after each successful login (assuming you're using a > >> DB > >> session store). Shouldn't be too hard to hook this in somewhere. > >> > > > > Yeah, but the point is that the session is being hijacked. If this is > > the case, it's almost certain that the user has the same session > > cookie/id, so this wouldn't help. > > > > -- > > Justin Patrin > > > > -- > > > > PEAR General Mailing List (http://pear.php.net/) > > To unsubscribe, visit: http://www.php.net/unsub.php > > > > > -- Justin Patrin