Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!eternal-september.org!feeder.eternal-september.org!mx04.eternal-september.org!.POSTED!not-for-mail From: "Peter H. Coffin" Newsgroups: comp.lang.php Subject: Re: sessions causing refreshing not to work Date: Sun, 3 Jun 2012 22:20:57 -0500 Organization: A noiseless patient Spider Lines: 25 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Injection-Info: mx04.eternal-september.org; posting-host="le/2G4+BNpieVhQI6uJ2Lw"; logging-data="8685"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/qvjux6jJORFGzJt6V4p06" User-Agent: slrn/0.9.9p1 (OpenBSD) Cancel-Lock: sha1:ODI7wVL3YE3119aoSetY32Uyiqk= Xref: csiph.com comp.lang.php:6243 On Sun, 03 Jun 2012 13:07:20 +0200, Fred wrote: > Le 03/06/2012 05:57, Peter H. Coffin a ?crit : > >> >> Set session.use_trans_sid, unset session.use_cookie, don't forget to >> grab the session ID out of the $_GET array for every page load. Yes, >> your URLs will be ugly, and it'll be not impossible for someone to end >> up screwing things somehow with URL bookmarking or sharing. >> > > session.use_trans_sid and session.use_cookie are 2 ways to manage > session but the result will be the same. Allowing the use of something is not the same as forcing the use of something. Either option can be allowed or disallowed independantly. It's kind of important because the "default", the type that all the doco talk about, is session via cookie. Session via $_GET is a bit more manual (you have to fetch the SID explicitly), and the way that the configuration stuff is set up allows for other means of store/fetching session IDs, which may someday come along. -- 22. No matter how tempted I am with the prospect of unlimited power, I will not consume any energy field bigger than my head. --Peter Anspach's list of things to do as an Evil Overlord