Menu
Community /Pin to ProfileBookmark
@NogDogFeb 26.2015 — #When PHP creates a new session, it generates a unique, pseudo-random token to identify it. That token is exchanged with the client via a cookie (the "session cookie"). As long as that session cookie is not intercepted (e.g. by a man-in-the-middle attack, which becomes much, much more difficult if you limit access to HTTPS), the session data for that user will stay local to only that user. @NogDogFeb 26.2015 — #Note that the only session "data" exchanged with the client is the session ID in the cookie. All the data in $_SESSION stays on the web server (in a file by default, in the DB if you configure/code it that way). So, as long as you protect that cookie (HTTPS, again), a user's session data should not be accessible by any other user. That being said, I'd still never store a password in the session data, as it should never be needed and is therefore an unnecessary risk (in case someone does sneak a peak into the session data one way or another). @NogDogFeb 27.2015 — #Generally, once they log in, you just need [i]something[/i] in $_SESSION that you can check for to see if they've already logged in -- could be the user name, or simply a boolean "logged_in" array element. Then your typical logic would be something like:
[RESOLVED] Understanding SESSIONS right?
When I start a session for a user, and once that user has logged in and session varibles (memberid, username, password) are set, how does PHP know one user session from another? Is there even a remote chance that userA’s session will collide, somehow, with userB’s? Trying to wrap my mind around this.
Sign in
to post a comment15 Comments(s) ↴
0
@NogDogFeb 26.2015 — #0
@NogDogFeb 26.2015 — #0
@NogDogFeb 27.2015 — #Generally, once they log in, you just need [i]something[/i] in $_SESSION that you can check for to see if they've already logged in -- could be the user name, or simply a boolean "logged_in" array element. Then your typical logic would be something like:[code=php]
<?php
session_start();
if(empty($_SESSION['user_name']))
{
// load login form, display non-logged in page, or whatever
}
else {
// user is logged in, so we're good to go
}
[/code]