Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #15053

Re: session management

Show all headers | View raw

On 05/03/15 13:59, mrr wrote:
> On 03/05/2015 11:54 AM, Erwin Moller wrote:
>> On 3/5/2015 8:51 AM, mrr wrote:


>> That is solved with a session-cookie.
>> It looks like this:
>> PHPSESSID:3hgsdfa5fhjgfsd8fhjg
>
> My friend swore me he doesn't use (nor need so) cookie. I don't yet have
> access to his code. On the other side he is still a beginner (6 months
> of many hours a day learning, no previous studies) and he sometimes uses
> advanced functionality (inside some JavaScript frameworks for example)
> without really knowing what's going on.

He may not use the setcookie() function, just the session_start() 
function, this will create the session cookie, which is just a normal 
cookie which stores a session identifier.

There is a way to do this without a cookie, then you add the session id 
information to the URL. This is less secure than using the cookie.



> I thought session variables were tight to a session with a particular
> client.

In default configuration it's just tied to the session id, but you can 
make your custom session handler and use the IP or/and user agent to tie 
the session even closer to one specific user, but users may use tor 
which could give you another IP next time you request the page and of 
course both IP and user agent can be spoofed.


> Let's say you have 2 registered users in your database, Charles and
> Aude. On you main page you have a "connection" link that leads you to a
> form where you're asked for your name. The client enter "Charles", the
> server checks and sees "Charles" in the database. It founds it, fill in
> a "name" session variable with "Charles" and eventually retrieve
> Charles' personal information in the database.

Charles has a cookie saying session id is weouiyr23uoi23

> Now Aude comes in and connect too.
>
> The server is dealing with 2 sets of session variables. It knows that
> Charles and Aude are connected (and will be connected for ever until
> they restart their browsers).

Aude has now a cookies saying session id is p09o4355rwesljh3

> So now:
> If Charles click to visit further the website, the server *has* to know
> that it's dealing with the set of session variable where name="Charles",
> with that particular session, no?

Charles browser will send the cookie with the session id weouiyr23uoi23 
every time he is loading a page, the PHP will then look up the session 
file which is stored on disk and store the data to the $_SESSION array.


> If so, on each page of the website Charles visit, the server could first
> test for the value of the name variable and if present in the database
> prints whatever it wants about Charles.

By default session is stored on a file, but you can write your own 
session handler which uses a database instead.
(no databases do not print, the fetch data and send it to clients, like 
php).


-- 

  //Aho

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

session management mrr <mireero@free.fr> - 2015-03-05 08:51 +0100
  Re: session management Erwin Moller <erwinmollerusenet@xs4all.nl> - 2015-03-05 11:54 +0100
    Re: session management mrr <mireero@free.fr> - 2015-03-05 13:59 +0100
      Re: session management Erwin Moller <erwinmollerusenet@xs4all.nl> - 2015-03-05 14:18 +0100
        Thank all! Re: session management mrr <mireero@free.fr> - 2015-03-06 13:47 +0100
          Re: Thank all! Re: session management "J.O. Aho" <user@example.net> - 2015-03-07 08:53 +0100
        Re: session management Jørn Andersen <jorn@jorna.dk> - 2015-03-07 11:59 +0100
          Re: session management "J.O. Aho" <user@example.net> - 2015-03-07 14:21 +0100
            Re: session management mrr <mireero@free.fr> - 2015-03-11 22:23 +0100
              Re: session management Jerry Stuckle <jstucklex@attglobal.net> - 2015-03-11 16:40 -0400
              Re: session management "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-03-11 21:59 +0100
                Re: session management mrr <mireero@free.fr> - 2015-03-13 01:05 +0100
            Re: session management Jørn Andersen <jorn@jorna.dk> - 2015-03-13 02:37 +0100
              Re: session management "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-03-13 02:54 +0100
          Re: session management Richard Damon <Richard@Damon-Family.org> - 2015-03-07 11:29 -0500
          Re: session management Erwin Moller <erwinmollerusenet@xs4all.nl> - 2015-03-09 11:29 +0100
      Re: session management "J.O. Aho" <user@example.net> - 2015-03-05 18:22 +0100
    Re: session management Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-03-06 11:33 +0100
  Re: session management Ben Bacarisse <ben.usenet@bsb.me.uk> - 2015-03-05 11:55 +0000

csiph-web