Re: [PHP4BETA] Forcing a new Session ID?

On Tue, Oct 26, 1999 at 04:33:23PM -0400, Jon E. Mitchiner wrote: > The reason why I am asking aainly is because lets say if someone has cookies > disabled (so thus, sessions would work via get mode), copies & pastes the > URL and gives it to someone else (perhaps the user hasnt finished shopping) > and then the new user tries to access the URL. I just wanted to make it more > "user friendly" by forcing the user to get a new session, which would then > force him to re-login again, etc. Yes, this can create fascinating scenarios. An existing workaround is to set session.extern_referer_check to the domain of your site. If a request's referer does not contain that text string, the session id is discarded. This catches most oversights, but does not account for malicious fake attempts, nor will it work with broken proxies which discard referers. -- Regards, Sascha Schumann Consultant