URGENT Security Issue

mickro

Hi,

Is there any way that $PHP_AUTH_USER and $PHP_AUTH_PW could be cached behind a Firewall?
I am doing HTTP authentication but when a user returns to the site they are still logged in.
It seems to only be a problem on a site where the users are behind Novell Border Manager.
Please help

Mike

Anon

... the username and password will stay cached.

mickro

Chad,

They are closing the browser and coming back hours later and they are still logged in. Also users on other terminals are finding that they are logged in as the wrong person.
This is very worrying!!
Any other ideas?

Mike

Anon

At
http://www.php.net/manual/en/ref.session.php

The post by linus@mediasvar.se complains about the same problem. The editors say this is not an issue if you ensure that PHP doesn't allow page caching.

Check that the following is set in the php.ini file

session.cache_limiter=nocache;

hopes this helps,
Tim

mickro

Tim,

Thanks for your reply. Sorry, but I forgot to mention that I am using php3 and there is no such command in php.ini.

Any other ideas?

Thanks

Mike

Anon

The only thing I can otherwise suggest is (again in the php.ini file, php4, anyway) is to set cookie lifetime:

session.cookie_lifetime=0;

is the relevant line. If it's set to 0, the cookie lasts until the browser is restarted.

Hope this helps, if not, good luck.

Tim