How to prevent PHP sessions being shared between different apache vhosts? -


how prevent php sessions being shared between different apache vhosts?

i've set different vhosts on apache 2.2 , works perfectly, until realized php sessions shared default.

edit reason why should set session_save_path or use database session handling if on shared webhosting. can create session id , chmod 777 , use session id on site bypass logins/or more privileges.

this works because php doesn't enforce session ids belongs site. know because i've analysed c/c++ source code behind sessions in php, , because wondered how possible. never put trust $_session array safe on shared web hosting , can't safely use value in sql query.

some code (file session.c) in php c function php_session_start(); yes, function called when call session_start() php (and check saw in these lines of code):

/* check whether current request referred  * external site invalidates found id. */  if (ps(id) &&         ps(extern_referer_chk)[0] != '\0' &&         pg(http_globals)[track_vars_server] &&         zend_hash_find(z_arrval_p(pg(http_globals)[track_vars_server]), "http_referer", sizeof("http_referer"), (void **) &data) == success &&         z_type_pp(data) == is_string &&         z_strlen_pp(data) != 0 &&         strstr(z_strval_pp(data), ps(extern_referer_chk)) == null ) {     efree(ps(id));     ps(id) = null;     ps(send_cookie) = 1;     if (ps(use_trans_sid) && !ps(use_only_cookies)) {         ps(apply_trans_sid) = 1;     } }

the check http header "http_referer", know can faked, "security through obscurity". safe method use session_save_path or use database session handler.

to set session_save_path in php.ini, should find more information here http://php.net/manual/en/session.configuration.php.

or, if php running apache module, can configure in htaccess file of vhost container:

php_value session.save_path "path"

or better phpinidir per vhost:

<virtualhost ip> [...] phpinidir /var/www/... [...] </virtualhost>

update [panique]:

i'm adding full solution answer, might other people too. sample full vhost setup:

<virtualhost *:81>     documentroot /var/www/xxx1     <directory "/var/www/xxx1">         allowoverride         php_value session.save_path "/var/mysessionforproject_1"    </directory> </virtualhost>  <virtualhost *:82>     documentroot /var/www/xxx2     <directory "/var/www/xxx2">         allowoverride         php_value session.save_path "/var/mysessionforproject_2"    </directory> </virtualhost>

Comments

Post a Comment

Popular posts from this blog

c# - Send Image in Json : 400 Bad request -

from android trying send image class of data, iis webservice. (c#) the problem 400 bad request . the image being encoded base64 . , placed json rest of class elements. my guess base64 not valid inside json. server not understand it. if set string "" , post accepted fine. so question is, how make base64 valid within json array? ( tried url.encode no success). or how should send image android webservice? gson gson = new gson(); string json = gson.tojson(record); // record has param { string base64photo } how big image? i'm pretty sure surpassing iis json size limit (default 4 mb). check http://geekswithblogs.net/frankw/archive/2008/08/05/how-to-configure-maxjsonlength-in-asp.net-ajax-applications.aspx or http://www.webtrenches.com/post.cfm/iis7-file-upload-size-limits good luck!
Read more

javascript - addthis share facebook and google+ url -

i attempting use addthis create simple url shares whichever current page user on when click share button. of right now, have twitter working. when user clicks, able see url populated in tweet box. when user clicks facebook or google+, url doesn't seem show in share box. <ul class="addthis_toolbox addthis_default_style "> <li><a class="addthis_button_facebook"><img src="/img/facebook-social.png" width="20" height="20" border="0" alt="share" /></a></li> <li><a class="addthis_button_twitter"><img src="/img/twitter-social.png" width="20" height="20" border="0" alt="share" /></a></li> <li><a class="addthis_button_google_plusone_share"><img src="/img/google-social.png" width="20" height="20" border="0" alt="s...
Read more

ios - Show keyboard with UITextField in the input accessory view -

i have buttona , when buttona clicked, want keyboard show uitextfield in inputaccessoryview. there way have keyboard show manually , set inputaccessoryview without having uitextfield initially? thanks. you cannot summon keyboard without object can become first responder. there 2 ways work around: subclass uiview , implement uikeyinput protocol in it. example: in .h file: @interface inputobject : uiview<uikeyinput> @property (nonatomic, copy) nsstring *text; @property (nonatomic, strong) uiview *inputaccessoryview; // must override inputaccessoryview , since it's readonly default @end in .m file, implement protocol: - (bool)canbecomefirstresponder { return yes; } - (bool)hastext { return [self.text length]; } - (void)inserttext:(nsstring *)text { nsstring *selftext = self.text ? self.text : @""; self.text = [selftext stringbyappendingstring:text]; [[nsnotificationcenter defaultcenter] postnotificationname:kinputobjec...
Read more