Re[4]: [PEAR] session cross between users?

Hi!, I'm using file based php sessions under php5. The thing surprised my is that we are talking about this problem 'quitely' and I think is a very serious problem that php would have resolved. Perhaps I don't understand the base of problem and my session handler code is bad but I think is a php session system responsability. Sorry about my poor english. Thanks. Thursday, November 18, 2004, 11:30:09 PM, vas escriure: JP> On Thu, 18 Nov 2004 23:09:25 +0100 (CET), leo@calidae.net JP> <leo@calidae.net> wrote: >> Well, I'm using Auth to validate users in my application. >> The solution that says Justin means that every time I have a cross session >> now forces a logout in the application? JP> It should be possible to not force a logout, but I couldn't find it JP> quickly. If you do some more research on creating a new session you JP> should be able to do it. You could also use PEAR's HTTP_Session. >> Is it , this is not the solution I >> need. I want that the user don't have a cross session and continue with >> his session. Another matter is that my php session timeout is too small. JP> So turn it up. It's a setting in the php.ini. >> I'm thinking change the Auth mechanism to a LiveUser autentication system. >> Do you reccomend it? My problems can disappear if I use LiveUser and not >> Auth? JP> No idea, sorry. If the problem is with the PHP session handler, JP> changing to a different system is unlikely to help. JP> Are you using the normal file-based PHP sessions or DB sessions? >> >> Thanks >> >> >> >> > On Thu, 18 Nov 2004 21:02:21 -0000, subs <subs@snackfood.org> wrote: >> >> >> >> >> >> > On Thu, 18 Nov 2004 14:04:32 -0500, Erik Heerlein >> >> > <erik@erikheerlein.com> wrote: >> >> > > That IP validation may be a problem if the user is on a AOL >> >> > account as >> >> > > an AOL users IP can change on the fly. >> >> > > >> >> > >> >> > Are you absolutely sure of that? Dial-up users' IPs can >> >> > change between dial-ups, but I doubt they're going to change >> >> > on-the-fly. If they did, the internet simply wouldn't work. >> >> > >> >> > Unless, of course, they're using some kind of round-robin >> >> > proxy system, but usually a user gets directed to one and >> >> > stays there for the entire session. >> >> > >> >> >> >> Some proxy clusters will often present a number of different addresses >> >> to a >> >> remote server during a session. Any authentication/authorization >> >> mechanism >> >> which relies on REMOTE_ADDR is generally a bad idea IMHO. >> >> You could add a user_id field to your sessions table and do the >> >> equivalent >> >> of "DELETE FROM sessions WHERE user_id = <user_id> AND session_id != >> >> <new_session_id>" after each successful login (assuming you're >> >> using a >> >> DB >> >> session store). Shouldn't be too hard to hook this in somewhere. >> >> >> > >> > Yeah, but the point is that the session is being hijacked. If this is >> > the case, it's almost certain that the user has the same session >> > cookie/id, so this wouldn't help. >> > >> > -- >> > Justin Patrin >> > >> > -- >> >> >> > PEAR General Mailing List (http://pear.php.net/) >> > To unsubscribe, visit: http://www.php.net/unsub.php >> > >> > >> JP> -- JP> Justin Patrin -- Salutacions, Leo Márquez [ Enginyeria del software / Internet ] [ Calidae - www.calidae.com ]