Auth Advanced Security Features
| From: | Hollenbeck, Dan | Date: | Mon, 30 Jun 2008 17:49:27 +0000 |
| Subject: | Auth Advanced Security Features | ||
| References: | 1 | Groups: | php.pear.general |
| Request: | Send a blank email to pear-general+get-29046@lists.php.net to get a copy of this message | ||
Hi,
Has anyone successful deployed Auth with the advanced security features
enabled? If yes, did you have any false positives?
I have recently deployed a web application that uses Auth as the
authenication system. On initial deployment I turned on all of the
advanced security features, however I am now getting about 2% of my
users being logged out because the advanced security features detected a
security breach. I just spoke to one user whos ISP is ATT-Yahoo who was
constantly being logged out because her browser version appears to be
changing.
I am aware I can turn off specific advanced security features like this:
$a = new AuthExtended("DB", $options, "loginFunction");
$a->setAdvancedSecurity(array(
AUTH_ADV_IPCHECK => true,
AUTH_ADV_USERAGENT => false,
AUTH_ADV_CHALLENGE => true
));
Thanks, Dan
Dan