Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:71553
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain lsces.co.uk from 217.147.176.204 cause and error)
Message-ID: <52E389B9.4060707@lsces.co.uk>
Date: Sat, 25 Jan 2014 09:54:01 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0 SeaMonkey/2.23
MIME-Version: 1.0
To: internals@lists.php.net
References: <CAPhkiZyMULFgCoTaaqtwx_34ovTX-36dTdVUgMXE_aWPd5O+WQ@mail.gmail.com>	<52E31FB6.9010408@ajf.me> <CAPhkiZwv_S1DwVhAMKfnzhJD1qycEwowVZ+BG8PTFQLX9GyNsw@mail.gmail.com>
In-Reply-To: <CAPhkiZwv_S1DwVhAMKfnzhJD1qycEwowVZ+BG8PTFQLX9GyNsw@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Session IP address matching
From: lester@lsces.co.uk (Lester Caine)

Andrey Andreev wrote:
>>> Yes, one can write a custom session handler, but there's a number of
>>> >>problems with that:
>> >
>> >Correct me if I'm wrong, but why would you need to do that? Surely, this
>> >would suffice:
>> >
>> >     if (!isset($_SESSION['ip'])) {
>> >         $_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
>> >     } else if ($_SERVER['REMOTE_ADDR'] !== $_SESSION['ip']) {
>> >         session_destroy();
>> >     }
>> >
>   - I don't want the IP stored in session data, I already know it.
>   - filemtime() result of the potentially targeted session id is
> changed, extending its expiry time
>   - multiple set-cookie headers
>
> Basically, I want it to be perfect.:)

Since nowadays the vast majority of 'users' do not have fixed IP addresses, and 
the methods used to share IP's on mobile phones is making that even more of a 
problem. It has already been pointed out that this can't be a default. 
Personally I keep track of the visitor IP's in a database and so have my own 
handling and I'm fairly sure most frameworks also do that. So I do not believe 
it leaves many options that could be considered safe to use as an alternative?

So to
> So much needed in fact, that I'm surprised PHP made it to 2014 without that
> option, especially since there already is 'session.referer_check'.
the answer is - because no one can come up with something that is safe to use?

-- 
Lester Caine - G8HFL
-----------------------------
Contact - http://lsces.co.uk/wiki/?page=contact
L.S.Caine Electronic Services - http://lsces.co.uk
EnquirySolve - http://enquirysolve.com/
Model Engineers Digital Workshop - http://medw.co.uk
Rainbow Digital Media - http://rainbowdigitalmedia.co.uk