Re: [PHP4BETA] session security?

On Sun, 5 Dec 1999, Cris Daniluk wrote: CD> It appears that you can use the fact that sessions will create themselves to arbitrarily CD> create sessions (ie file.php?PHPSESSID=test).. I would also assume that since no IP or other CD> identifying information is stored within the session (which would be hard to do because of proxies, CD> etc) that you could then put in any existing session that may or may not belong to you and begin CD> using it. I noticed this when writing routines to hook the session handlers and store everything in a mysql database. I got around it by grabbing the SID before starting the sesssion, checking if it exists in my database, if it doesnt then unset() the SID and startup the session as normal. This will force php to ignore the passed SID and generate a new one. I dont know how you can get around this with the file sessions though, maybe you can do something similier and check if the file exists(?) (I'm not sure how the files get stored). My work around will only work if you are hooking the functions via session_set_save_handler(). PS: Is anyone else having trouble with the session_set_save_handler() hooks? php4b3 is not calling my write or close function when the user script processing is done. I am currently forced to make the write out occur in a auto append. -d -- (void *)0