RE: [PHP4BETA] Forcing a new Session ID?

The reason why I am asking aainly is because lets say if someone has cookies disabled (so thus, sessions would work via get mode), copies & pastes the URL and gives it to someone else (perhaps the user hasnt finished shopping) and then the new user tries to access the URL. I just wanted to make it more "user friendly" by forcing the user to get a new session, which would then force him to re-login again, etc. I guess I'll have to think about this issue in depth, and possibly force users to use cookies which I was trying to avoid. Thanks! Jon Mitchiner ICQ # 21030881 AIM # MinotaurT > -----Original Message----- > From: Sascha Schumann [mailto:sascha@schumann.cx] > Sent: Tuesday, October 26, 1999 4:24 PM > To: Jon E. Mitchiner > Cc: php4beta@lists.php.net > Subject: Re: [PHP4BETA] Forcing a new Session ID? > > > On Mon, Oct 25, 1999 at 08:25:20PM -0400, Jon E. Mitchiner wrote: > > Im trying to implement some security routines with the Session > ID processing > > so if someone tries hijacking someone else's session based on certain > > variables that fail then they will be forced to get a new session id. > > > > Ive been trying to figure this out, but have had no luck. What > would be the > > best way to do this -without- destroying the existing user's session. > > If you think that a specific session was hijacked, destroy > the session. I don't see any point in trying to rescue the > session (if a session id was leaked once, there is a high > propability that it will happen again). Thus, we supply only > session_destroy(). > > -- > > Regards, > > Sascha Schumann > Consultant > > -- > PHP 4 Beta >