Sessions with PHP4

Anon

Here goes...

I have a site which uses sessions but one thing that I am not too clear about is how and when the session will terminate.

Close the browser and reloading would create a new session, but moving to other sites then going back to the site doesn't seem to terminate the session.

How would I do it?

Many Thanks in advance.

Bob

yelvington

<?
session_start();
session_destroy();
header("Location: login.php");
?>

Anon

Thanks for the advice.

I have one other question though. When would be the best time to run the above code?

When a user is browsing using the hyperlinks you have provided througout the site, all is fine, you use the initial login they provided.

If they move away from my site to another site, and then at somepoint come back to site, should I force a new login or should I re-use the existing login. If I should force a new login, how can my various web site pages determine whether they are simply browsing through the various pages or returning back to the site at a later time?

I hope someone can help me?

Thank you in advance.
Bob

synaesthesia

Bob,

It depends on what the purpose of your site is and who your intended audience is. If you have a site that has sensitive information stored or you have an audience that is using common terminals (like at a public library, Internet cafe, or college computer lab), then you'll definitely want to force another login. Many times, people will forget to close their browsers or they'll step away from the computer; you don't want someone accidentally stumbling into another person's session. But if this isn't the case, then just don't worry about it. There's no need to explicitly end a session.

But let's say you do want to end a session. The key concept here is session timeout. Every time a user arrives on one of your page, you should check to see whether or not a certain amount of time has passed since the last time they have arrived on one of your pages. Let's say I go to your website at 10:30. I surf around awhile, go have lunch, talk to my cat for a bit, and then return to your website at 12:30. When I arrive at the page, you should know that the last time I was at your site was at 10:30, and if two hours is too long, then you should time out the session, destroy the session variables, and redirect me to a login page with a message saying that my session has timed out.

There are a lot of examples of how to code a session timeout around the Net. Some things to remember:

1.) Create a variable that has the time that the person hit the page.
2.) Check that time against the current time.
3.) If the time is too long, destroy session and redirect.
4.) If the time is okay, set variable to current time and continue with the page.

Of course, if you want to be really wacky about it, you can always check the HTTP_Referer on every page, and if it comes from a domain that isn't yours, destroy the session and redirect them to a login page with a message saying that they've come from a site outside of your domain.

Hope this helps.

-- Lee

Anon

Thanks for valuable help Lee.

One other question, how to do you check the
HTTP_Referer on every page?

Many Thanks

synaesthesia

Try this:

<?
$domain = "www.yourdomain.com";

$referer = parse_url($HTTP_REFERER);

if ($referer[host] != $domain) {

}
?>

Check to see if the host and referer info match. $HTTP_REFERER will grab the referer URL for us. The parse_url function will break up this URL into an array containing the elements scheme, host, post, user, pass, path, query, and fragment. (Reference: http://www.php.net/manual/en/function.parse-url.php) So you're looking to compare your domain against the element host in the array created when you used parse_url against $HTTP_REFERER.

If it doesn't match, do something horrible, like redirecting to another page that explains the error and asks for a login. But if it does get past the if statement, then it's okay, and you can continue with the page.

Make sure that if you do redirect that you do so before you write anything to the page. That means no HTML stuff, no echos, and most insidiously of all, no blank spaces.

Lee