Path: csiph.com!usenet.pasdenom.info!aioe.org!eternal-september.org!feeder.eternal-september.org!mx02.eternal-september.org!.POSTED!not-for-mail From: Ben Bacarisse Newsgroups: comp.lang.php Subject: Re: session management Date: Thu, 05 Mar 2015 11:55:04 +0000 Organization: A noiseless patient Spider Lines: 30 Message-ID: <87sidjr753.fsf@bsb.me.uk> References: <54f7fce9$0$2983$426a74cc@news.free.fr> Mime-Version: 1.0 Content-Type: text/plain Injection-Info: mx02.eternal-september.org; posting-host="017616aa25f81ec581c44d76d61ba2f3"; logging-data="6503"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+QB3witpGxb45LoxypVU/0GHDa5SX8xqg=" Cancel-Lock: sha1:dw5U3Y6Ydfemn4jvGzv6iCG/DwQ= sha1:C1pxmEhkWHQGOZZxr/1KiwYFiro= X-BSB-Auth: 1.f25570ca538637daf481.20150305115504GMT.87sidjr753.fsf@bsb.me.uk Xref: csiph.com comp.lang.php:15045 mrr writes: > I have a friend that is handling session only with well, session variables. > I always thought that was done with cookies. It's not either/or. It is common that a cookie is used for the session ID, though not for the variables themselves. > So when a member logs in, he checks in his database for > username/password and (if ok) then populates other session variables > which values are specific to this particular user. > On any page of the site, PHP begins by looking at those variables and > see if someone is logged in. > The user logs out either by clicking a dedicated link on the website, > either when shutting down the browser. That's fine for him. > > So no cookie, I never thought of staying that simple and it looks to > work nicely. Yes, PHP can manage the session without one. Are you sure that's what's going on here? > Is there any security/complication concern I should warn him about, in > this particular session handling? Yes, but I don't think this kind of security question can be answered, with this little data, in a short Usenet post. -- Ben.