Re: [PHP4BETA] Forcing a new Session ID?
| From: | Michaël Parienti | Date: | Wed, 27 Oct 1999 11:18:37 +0000 |
| Subject: | Re: [PHP4BETA] Forcing a new Session ID? | ||
| References: | 1 2 3 | Groups: | php.version4 |
| Request: | Send a blank email to php-version4+get-5723@lists.php.net to get a copy of this message | ||
Sascha Schumann a écrit :
>
> Yes, this can create fascinating scenarios. An existing
> workaround is to set session.extern_referer_check to the
> domain of your site. If a request's referer does not contain
> that text string, the session id is discarded.
>
And what about a verification with IP adresse of the client?
A new session is forced if a request is made with an
existing
sessionID, but from a client with another IP adresse.
Anyway, this can be done by hand, and not necessary in php4.
Michael Parienti