Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!news-1.dfn.de!news.dfn.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: "J.O. Aho" Newsgroups: comp.lang.php Subject: Re: session management Date: Thu, 05 Mar 2015 18:22:54 +0100 Lines: 74 Message-ID: References: <54f7fce9$0$2983$426a74cc@news.free.fr> <54f835eb$0$2851$e4fe514c@news2.news.xs4all.nl> <54f8450f$0$3374$426a34cc@news.free.fr> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: individual.net rPFcHnsECpPBfwUFmBEpQglGEbw01TMHc1ECZTxlsS+YEQc/rk Cancel-Lock: sha1:E88+xFD6ijqjiIe1nYc13cOpHq0= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0 In-Reply-To: <54f8450f$0$3374$426a34cc@news.free.fr> Xref: csiph.com comp.lang.php:15053 On 05/03/15 13:59, mrr wrote: > On 03/05/2015 11:54 AM, Erwin Moller wrote: >> On 3/5/2015 8:51 AM, mrr wrote: >> That is solved with a session-cookie. >> It looks like this: >> PHPSESSID:3hgsdfa5fhjgfsd8fhjg > > My friend swore me he doesn't use (nor need so) cookie. I don't yet have > access to his code. On the other side he is still a beginner (6 months > of many hours a day learning, no previous studies) and he sometimes uses > advanced functionality (inside some JavaScript frameworks for example) > without really knowing what's going on. He may not use the setcookie() function, just the session_start() function, this will create the session cookie, which is just a normal cookie which stores a session identifier. There is a way to do this without a cookie, then you add the session id information to the URL. This is less secure than using the cookie. > I thought session variables were tight to a session with a particular > client. In default configuration it's just tied to the session id, but you can make your custom session handler and use the IP or/and user agent to tie the session even closer to one specific user, but users may use tor which could give you another IP next time you request the page and of course both IP and user agent can be spoofed. > Let's say you have 2 registered users in your database, Charles and > Aude. On you main page you have a "connection" link that leads you to a > form where you're asked for your name. The client enter "Charles", the > server checks and sees "Charles" in the database. It founds it, fill in > a "name" session variable with "Charles" and eventually retrieve > Charles' personal information in the database. Charles has a cookie saying session id is weouiyr23uoi23 > Now Aude comes in and connect too. > > The server is dealing with 2 sets of session variables. It knows that > Charles and Aude are connected (and will be connected for ever until > they restart their browsers). Aude has now a cookies saying session id is p09o4355rwesljh3 > So now: > If Charles click to visit further the website, the server *has* to know > that it's dealing with the set of session variable where name="Charles", > with that particular session, no? Charles browser will send the cookie with the session id weouiyr23uoi23 every time he is loading a page, the PHP will then look up the session file which is stored on disk and store the data to the $_SESSION array. > If so, on each page of the website Charles visit, the server could first > test for the value of the name variable and if present in the database > prints whatever it wants about Charles. By default session is stored on a file, but you can write your own session handler which uses a database instead. (no databases do not print, the fetch data and send it to clients, like php). -- //Aho