Re: session management

Path	csiph.com!usenet.pasdenom.info!aioe.org!eternal-september.org!feeder.eternal-september.org!mx02.eternal-september.org!.POSTED!not-for-mail
From	Ben Bacarisse <ben.usenet@bsb.me.uk>
Newsgroups	comp.lang.php
Subject	Re: session management
Date	Thu, 05 Mar 2015 11:55:04 +0000
Organization	A noiseless patient Spider
Lines	30
Message-ID	<87sidjr753.fsf@bsb.me.uk> (permalink)
References	<54f7fce9$0$2983$426a74cc@news.free.fr>
Mime-Version	1.0
Content-Type	text/plain
Injection-Info	mx02.eternal-september.org; posting-host="017616aa25f81ec581c44d76d61ba2f3"; logging-data="6503"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+QB3witpGxb45LoxypVU/0GHDa5SX8xqg="
Cancel-Lock	sha1:dw5U3Y6Ydfemn4jvGzv6iCG/DwQ= sha1:C1pxmEhkWHQGOZZxr/1KiwYFiro=
X-BSB-Auth	1.f25570ca538637daf481.20150305115504GMT.87sidjr753.fsf@bsb.me.uk
Xref	csiph.com comp.lang.php:15045

Show key headers only | View raw

mrr <mireero@free.fr> writes:

> I have a friend that is handling session only with well, session variables.
> I always thought that was done with cookies.

It's not either/or.  It is common that a cookie is used for the session
ID, though not for the variables themselves.

> So when a member logs in, he checks in his database for
> username/password and (if ok) then populates other session variables
> which values are specific to this particular user.
> On any page of the site, PHP begins by looking at those variables and
> see if someone is logged in.
> The user logs out either by clicking a dedicated link on the website,
> either when shutting down the browser. That's fine for him.
>
> So no cookie, I never thought of staying that simple and it looks to
> work nicely.

Yes, PHP can manage the session without one.  Are you sure that's what's
going on here?

> Is there any security/complication concern I should warn him about, in
> this particular session handling?

Yes, but I don't think this kind of security question can be answered,
with this little data, in a short Usenet post.

-- 
Ben.

Back to comp.lang.php | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

session management mrr <mireero@free.fr> - 2015-03-05 08:51 +0100
  Re: session management Erwin Moller <erwinmollerusenet@xs4all.nl> - 2015-03-05 11:54 +0100
    Re: session management mrr <mireero@free.fr> - 2015-03-05 13:59 +0100
      Re: session management Erwin Moller <erwinmollerusenet@xs4all.nl> - 2015-03-05 14:18 +0100
        Thank all! Re: session management mrr <mireero@free.fr> - 2015-03-06 13:47 +0100
          Re: Thank all! Re: session management "J.O. Aho" <user@example.net> - 2015-03-07 08:53 +0100
        Re: session management Jørn Andersen <jorn@jorna.dk> - 2015-03-07 11:59 +0100
          Re: session management "J.O. Aho" <user@example.net> - 2015-03-07 14:21 +0100
            Re: session management mrr <mireero@free.fr> - 2015-03-11 22:23 +0100
              Re: session management Jerry Stuckle <jstucklex@attglobal.net> - 2015-03-11 16:40 -0400
              Re: session management "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-03-11 21:59 +0100
                Re: session management mrr <mireero@free.fr> - 2015-03-13 01:05 +0100
            Re: session management Jørn Andersen <jorn@jorna.dk> - 2015-03-13 02:37 +0100
              Re: session management "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-03-13 02:54 +0100
          Re: session management Richard Damon <Richard@Damon-Family.org> - 2015-03-07 11:29 -0500
          Re: session management Erwin Moller <erwinmollerusenet@xs4all.nl> - 2015-03-09 11:29 +0100
      Re: session management "J.O. Aho" <user@example.net> - 2015-03-05 18:22 +0100
    Re: session management Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-03-06 11:33 +0100
  Re: session management Ben Bacarisse <ben.usenet@bsb.me.uk> - 2015-03-05 11:55 +0000

csiph-web