Sagewire Logo

Sessions 102

5 Message(s) by 4 Author(s) originally posted in php language


From: David Basford Date:   Monday, October 22, 2007
if I search for $_SESSION['thing'] is it specific to my site?
can another person make a site, set up a session and set 'thing' and then
come to my site with it set?

As you see I'm new and sessions seem great but I want to know if this or
other things are a drawback
Any help guys?


From: ZeldorBlat Date:   Monday, October 22, 2007
wrote in message:
if I search for $_SESSION['thing'] is it specific to my site?
can another person make a site, set up a session and set 'thing' and then
come to my site with it set?
As you see I'm new and sessions seem great but I want to know if this or
other things are a drawback
Any help guys?



Session data is store d on the server , so, no.


From: Martin Mandl - m2m tech support Date:   Tuesday, October 23, 2007
wrote in message:
wrote in message:
> if I search for $_SESSION['thing'] is it specific to my site?
> can another person make a site, set up a session and set 'thing' and then
> come to my site with it set?
Session data is stored on the server, so, no.



... if that 'person' is on the same server and is able to duplicate
the way you access your session data (session id, etc.) ... then yes

... to prevent that you could to e.g. generate a new session id every
time a user comes from another site ...

good luck
Martin------------------------------------------------
online accounting on bash bases
Online Einnahmen-Ausgaben-Rechnung
http://www.ea-geier.at
------------------------------------------------
m2m server software gmbh
http://www.m2m.at


From: Isaac Raway Date:   Tuesday, October 23, 2007
On 2007-10-23 02:11:04 -0500, Martin Mandl - m2m tech support
<martin.mandl@xxxxxxxxxxx> said:

wrote in message:
wrote in message:

if I search for $_SESSION['thing'] is it specific to my site?
can another person make a site, set up a session and set 'thing' and then
come to my site with it set?

Session data is stored on the server, so, no.
... if that 'person' is on the same server and is able to duplicate
the way you access your session data (session id, etc.) ... then yes
... to prevent that you could to e.g. generate a new session id every
time a user comes from another site ...



Depends on what he means by "site". If you've your own domain , then
I'm pretty sure it is specific to your domain.

If you are on a subdomain or, worse, just a subdirectory of a domain,
the other directories on that domain can access the same session data.

Anyway, this is how I understand it. I guess that this might noe
accurate, but think about how wide open all these PHP scripts'd be
running on colocated servers if it were not domain specific.

If you use cookies to store the session ID, that abides by the rules of
cookie access which are domain specific (obviously).

IJR


From: ZeldorBlat Date:   Wednesday, October 24, 2007
wrote in message:
If you are on a subdomain or, worse, just a subdirectory of a domain,
the other directories on that domain can access the same session data.
Anyway, this is how I understand it. I guess that this might noe
accurate, but think about how wide open all these PHP scripts'd be
running on colocated servers if it were not domain specific.
If you use cookies to store the session ID, that abides by the rules of
cookie access which are domain specific (obviously).



Right -- including the rules about cookies being made specific to a
particular path. See the session.cookie_path directive in php.ini.



Next Message: trying to write instant messenger in php/ajax


Blogs related to Sessions 102

Navigation erweitern

Programming | Sports | Autos

copyright 2006
Valid XHTML 1.0 Transitional