user session handling - validation

[Anon]

Does anyone have any examples of validating a session id using user sessions? If possible, please include how you issue a new session id if the provided session id was invalid.

Thanks.

[Anon]

I believe there are four different articles on phpbuilder sessions. Have you looked at them?

http://www.phpbuilder.com/columns/

[Anon]

I'll first start the session normally and then check the user's IP address and/or referrer against the IP address of the session and a list of valid referrers. If its an invalid (meaning the IP address doesn't match or the referrer is not in the list), I'll create a new unique session ID and set the session to that value using session_id with the new ID value as its argument.

I then start the session a second time (consecutive calls to session_start() do not appear to cause any errors in my testing), and unset the session (starting clean).

I can then proceed on, using the session as I would normally.

I've done some basic testing and this seems to work. I'm still curious what impact it will have if the user has a session cookie and they click a URL that has a session ID imbedded in it. It will be interesting to see which value takes presidence, the cookie or URL propogated session ID.

[Anon]

It seems like I've read somewhere that the order of precedence goes like this:

cookie vars trump post or get
post vars trump get
get trumps no one

I looked for something to confirm that in the manual, but I couldn't find it. Perhaps someone else can find documentation for this?