Sessions 102
5 Message(s) by 4 Author(s) originally posted in php language
| From: David Basford |
Date: Monday, October 22, 2007
|
if I search for $_SESSION['thing'] is it specific to my site?
can another person make a site, set up a
session and set 'thing' and then
come to my site with it set?
As you see I'm new and sessions seem great but I want to know if this or
other things are a drawback
Any help guys?
| From: ZeldorBlat |
Date: Monday, October 22, 2007
|
wrote in message:
if I search for $_SESSION['thing'] is it specific to my site?
can another person make a site, set up a session and set 'thing' and then
come to my site with it set?
As you see I'm new and sessions seem great but I want to know if this or
other things are a drawback
Any help guys?
Session
data is
store d on the
server , so, no.
| From: Martin Mandl - m2m tech support |
Date: Tuesday, October 23, 2007
|
wrote in message:
wrote in message:
> if I search for $_SESSION['thing'] is it specific to my site?
> can another person make a site, set up a session and set 'thing' and then
> come to my site with it set?
Session data is stored on the server, so, no.
... if that 'person' is on the same server and is able to duplicate
the way you access your session data (session id, etc.) ... then yes
... to prevent that you could to e.g.
generate a new session id every
time a user comes from another site ...
good luck
Martin------------------------------------------------
online accounting on
bash bases
Online Einnahmen-Ausgaben-Rechnung
http://www.ea-geier.at
------------------------------------------------
m2m server
software gmbh
http://www.m2m.at
| From: Isaac Raway |
Date: Tuesday, October 23, 2007
|
On 2007-10-23 02:11:04 -0500, Martin Mandl - m2m tech
support
<martin.mandl@xxxxxxxxxxx> said:
wrote in message:
wrote in message:
if I search for $_SESSION['thing'] is it specific to my site?
can another person make a site, set up a session and set 'thing' and then
come to my site with it set?
Session data is stored on the server, so, no.
... if that 'person' is on the same server and is able to duplicate
the way you access your session data (session id, etc.) ... then yes
... to prevent that you could to e.g. generate a new session id every
time a user comes from another site ...
Depends on what he means by "site". If you've your own
domain , then
I'm pretty sure it is specific to your domain.
If you are on a subdomain or, worse, just a subdirectory of a domain,
the other directories on that domain can access the same session data.
Anyway, this is how I understand it. I guess that this might noe
accurate, but think about how wide
open all these PHP scripts'd be
running on colocated servers if it were not domain specific.
If you use cookies to store the session ID, that abides by the rules of
cookie access which are domain specific (obviously).
IJR
| From: ZeldorBlat |
Date: Wednesday, October 24, 2007
|
wrote in message:
If you are on a subdomain or, worse, just a subdirectory of a domain,
the other directories on that domain can access the same session data.
Anyway, this is how I understand it. I guess that this might noe
accurate, but think about how wide open all these PHP scripts'd be
running on colocated servers if it were not domain specific.
If you use cookies to store the session ID, that abides by the rules of
cookie access which are domain specific (obviously).
Right -- including the rules about cookies being made specific to a
particular path. See the session.cookie_path directive in php.ini.
Next Message: trying to write instant messenger in php/ajax
Blogs related to Sessions 102
Navigation erweitern