[RESOLVED] Session Security Question

xxdalexx

My main question are session variables local to the user, or does a session id need to be different to everyone that visits your site? Right now I'm assuming they are local, but worried I'm wrong. The way I have it handled right now is the session id is the same for everyone, but if I set a session variable defining the user type between regular and admin, when the admin signs in it wouldn't change everyone's type to admin would it?

dagon

ouch let php set the session id, unless you have a good reason to do it yourself.

bradgrafelman

If you're changing the session id (e.g. via [man]session_id/man) so that everyone gets the same id, then yes, everyone will get the same session data. That should make sense; the session identifier is used to identify which session to load.

xxdalexx

So if I just do a session_start(), and don't mess with session_id(), all will be good?

bradgrafelman

xxdalexx;10968759 wrote:
So if I just do a session_start(), and don't mess with session_id(), all will be good?

That's the most common way to use PHP sessions, yes.

xxdalexx

Ok, Thank you very much.

xxdalexx

Sorry, I realize this is probably a redundant question that I think I know the answer to, just want to make sure. PHP assigns everyone their own session id, so then everyone can have the same session_name() set with out any conflicts correct?

dagon

xxdalexx;10968762 wrote:
Sorry, I realize this is probably a redundant question that I think I know the answer to, just want to make sure. PHP assigns everyone their own session id, so then everyone can have the same session_name() set with out any conflicts correct?

correct