Sessions Problem

[lorenzdominic_@hotmail.com]

Hi
I am new to sessions and php and have been playing around with them -
and would like to know why this is happening?

Firstly I have a login page and it goes to a verify page which creates
a session like so:

>From verify.php-

ini_set("sessio n.save_handler" , "files");
session_save_pa th ("mywebsite. com/tmp");
session_name();
session_start() ;
session_registe r("user");

I then redirect to the users page like this:
$url= "Location:mypag e.php";
header($url);
exit();


Once in mypage.php
I use the following session functions - I have to keep using the fist
two lines in my php pages which use sessions as it was requested by my
ISP:

>From mypage.php-

ini_set("sessio n.save_handler" , "files");
session_save_pa th ("mywebsite. com/tmp");
session_start() ;

Now comes the strange part or is it?
I can access the "user" variable which was registered by the verify
page. I do this WITHOUT any references to the correct Session ID as
follows:


print $user;


How is this possible?


My question is how does PHP know which Session ID is the correct one if

I have hundreds of users and I am not giving PHP the correct Session ID

just calling a variable from within a Session object?


Please help this is really weird and seems buggy??????????
Regards
Dominic

[bpuzon]

Re: Sessions Problem

lorenzdominic_@ hotmail.com wrote:

>My question is how does PHP know which Session ID is the correct one if
>I have hundreds of users and I am not giving PHP the correct Session ID
>just calling a variable from within a Session object?

As stated in the php manual (which is your best friend), the session_id is
silently addedd to any requests you make after you've starter the session.

--
Z powazaniem
Bartek Puzon

[lorenzdominic_@hotmail.com]

Re: Sessions Problem

Hi thanks Bartek for your help.
If the Session ID is "silently added" what is the need to append a
Session ID to a URL when not using cookies?

As this is the way I thought I had to do it? I was appending the
Session ID to the URL when accessing another page.

However it appears this is not required and all the tutorials on
appending a Session ID to a URL are pointless.

Regards
Dominic


bpuzon wrote:

lorenzdominic_@ hotmail.com wrote:
>

My question is how does PHP know which Session ID is the correct one if
I have hundreds of users and I am not giving PHP the correct Session ID
just calling a variable from within a Session object?

>
As stated in the php manual (which is your best friend), the session_id is
silently addedd to any requests you make after you've starter the session.
>
--
Z powazaniem
Bartek Puzon

[Rik]

Re: Sessions Problem

lorenzdominic_@ hotmail.com wrote:

My question is how does PHP know which Session ID is the correct one
if
>
I have hundreds of users and I am not giving PHP the correct Session
ID
>
just calling a variable from within a Session object?
>
>
Please help this is really weird and seems buggy??????????

It think you got the wrong idea about how a session works.
As soon as you session_start() , either a cookie will be set, or, depending on
your settings, on on every link a GET variable will be set/hidden POST variables
will be set in the forms. This is a large random string, and identifies the
session.

On the next page request, either the user sends his previous set cookie, or will
tell PHP with GET or POST variable which session it uses. PHP will process this
automatically by session_start() without you having to code for it. It will
check for the existence of the session, and if it exists, will set the session
variables available in that partivular session. If you're worried about sessions
being used by other (unathorized) users, google for session hijacking.

My session id's are 32 byte haxedecimal numbers, 16^32 = +/- 3,4 * 10^38
possibilities (yes, I know the math is somewhat off on this one, it's just for
illustration). 10^38 possibilities will mean that even with hundreds of users,
someone has to be very, very, very lucky just to guess an active session. A few
extra check can be placed and it will be very safe.

Grtz,
--
Rik Wasmus

[Rik]

Re: Sessions Problem

lorenzdominic_@ hotmail.com wrote:

Hi thanks Bartek for your help.
If the Session ID is "silently added" what is the need to append a
Session ID to a URL when not using cookies?

The user/UA has to identify itself. There are mainly 3 possibilities:
1. Cookie (preferred).
2. POST variable
3. GET variable

As this is the way I thought I had to do it? I was appending the
Session ID to the URL when accessing another page.

When using GET variables, HTTPS is a must.

However it appears this is not required and all the tutorials on
appending a Session ID to a URL are pointless.

This is one of the things PHP will do automagically for you. Standard it will
try to set a cookie, unless you tell it otherwise. When using a cookie, no
url-rewriting is necessary.

Check the manual: http://www.php.net/manual/en/ref.session.php

Grtz,
--
Rik Wasmus

[bpuzon]

Re: Sessions Problem

lorenzdominic_@ hotmail.com wrote:

However it appears this is not required and all the tutorials on
appending a Session ID to a URL are pointless.

ini_set("sessio n.save_handler" , "files");
The line tells the system to save session data in the files on your server.
It doesn't mean "don't store SSID valuen in cookies on the user's machine".

ini_set("sessio n.use_cookies", 0)
This should turn the feature off, then you probably will have to pass SID
explicitly.

--
Z powazaniem
Bartek Puzon

[Jerry Stuckle]

Re: Sessions Problem

Rik wrote:

lorenzdominic_@ hotmail.com wrote:
>

>>Hi thanks Bartek for your help.
>>If the Session ID is "silently added" what is the need to append a
>>Session ID to a URL when not using cookies?

>
>
The user/UA has to identify itself. There are mainly 3 possibilities:
1. Cookie (preferred).
2. POST variable
3. GET variable
>
>

>>As this is the way I thought I had to do it? I was appending the
>>Session ID to the URL when accessing another page.

>
>
When using GET variables, HTTPS is a must.
>

And why is that? There's no major difference between GET and POST in
how the data is sent to the server. And the user could change the GET
param whether http or https is used.



--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attgl obal.net
=============== ===

[Rik]

Re: Sessions Problem

Jerry Stuckle wrote:

Rik wrote:

>When using GET variables, HTTPS is a must.
>>

>
And why is that? There's no major difference between GET and POST in
how the data is sent to the server. And the user could change the GET
param whether http or https is used.

You're absolutely right, I don't really know what I was thinking, I'm a little
bit off :-). (Offcourse I blame the fever, it couldn't possibly me normal self
making this mistake..:P) Regardless what method is used, if you want to prevent
session hijacking just use https instead of http.

Grtz,
--
Rik Wasmus

[Jerry Stuckle]

Re: Sessions Problem

Rik wrote:

Jerry Stuckle wrote:
>

>>Rik wrote:
>>

>>>When using GET variables, HTTPS is a must.
>>>

>>
>>And why is that? There's no major difference between GET and POST in
>>how the data is sent to the server. And the user could change the GET
>>param whether http or https is used.

>
>
You're absolutely right, I don't really know what I was thinking, I'm a little
bit off :-). (Offcourse I blame the fever, it couldn't possibly me normal self
making this mistake..:P) Regardless what method is used, if you want to prevent
session hijacking just use https instead of http.
>
Grtz,

I agree with this completely. Although https: does have more overhead,
if session hijacking is important you should protect it just like you
would credit card numbers.


--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attgl obal.net
=============== ===