On Sat, Jan 25, 2014 at 4:21 AM, Andrea Faulds <[email protected]> wrote:
>
>
> On 25/01/14 01:11, Andrey Andreev wrote:
>>
>> Yes, one can write a custom session handler, but there's a number of
>> problems with that:
>
>
> Correct me if I'm wrong, but why would you need to do that? Surely, this
> would suffice:
>
> if (!isset($_SESSION['ip'])) {
> $_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
> } else if ($_SERVER['REMOTE_ADDR'] !== $_SESSION['ip']) {
> session_destroy();
> }
>
- I don't want the IP stored in session data, I already know it.
- filemtime() result of the potentially targeted session id is
changed, extending its expiry time
- multiple set-cookie headers
Basically, I want it to be perfect. :)