Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:71547
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.216.65 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <52E31FB6.9010408@ajf.me>
References: <CAPhkiZyMULFgCoTaaqtwx_34ovTX-36dTdVUgMXE_aWPd5O+WQ@mail.gmail.com>
	<52E31FB6.9010408@ajf.me>
Date: Sat, 25 Jan 2014 05:15:12 +0200
Message-ID: <CAPhkiZwv_S1DwVhAMKfnzhJD1qycEwowVZ+BG8PTFQLX9GyNsw@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Session IP address matching
From: narf@devilix.net (Andrey Andreev)

On Sat, Jan 25, 2014 at 4:21 AM, Andrea Faulds <ajf@ajf.me> wrote:
>
>
> On 25/01/14 01:11, Andrey Andreev wrote:
>>
>> Yes, one can write a custom session handler, but there's a number of
>> problems with that:
>
>
> Correct me if I'm wrong, but why would you need to do that? Surely, this
> would suffice:
>
>     if (!isset($_SESSION['ip'])) {
>         $_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
>     } else if ($_SERVER['REMOTE_ADDR'] !== $_SESSION['ip']) {
>         session_destroy();
>     }
>

 - I don't want the IP stored in session data, I already know it.
 - filemtime() result of the potentially targeted session id is
changed, extending its expiry time
 - multiple set-cookie headers

Basically, I want it to be perfect. :)