search

halfer / php-tutorial-text

The chapter text for the "I ♥ PHP" project
14 stars 1 forks source link

Security improvements to session handling #2

Closed halfer closed 10 years ago

halfer commented 10 years ago

As it stands, there is no session identifier regeneration at log-on, and I think this could be improved. The code adjustment would be minor (one line) and can probably be explained just in comments -- I wonder if explaining it in the text also would be pitching at the wrong level for beginners.

This paper looks like relevant reading. Also this question and particularly this answer to it.

Comments/suggestions welcome.

halfer commented 10 years ago

A (code) fix for this is now available in the versions chooser (v4). If no issues are spotted with it, I'll make it the default version.

I added some comments to explain the session rotation - I've not explained it in the text, to avoid swamping the user.

halfer commented 10 years ago

All done.