How to prevent PHP sessions being shared between different apache vhosts? -

how prevent php sessions being shared between different apache vhosts?

i've set different vhosts on apache 2.2 , works perfectly, until realized php sessions shared default.

edit reason why should set session_save_path or use database session handling if on shared webhosting. can create session id , chmod 777 , use session id on site bypass logins/or more privileges.

this works because php doesn't enforce session ids belongs site. know because i've analysed c/c++ source code behind sessions in php, , because wondered how possible. never put trust $_session array safe on shared web hosting , can't safely use value in sql query.

some code (file session.c) in php c function php_session_start(); yes, function called when call session_start() php (and check saw in these lines of code):

/* check whether current request referred  * external site invalidates found id. */  if (ps(id) &&         ps(extern_referer_chk)[0] != '\0' &&         pg(http_globals)[track_vars_server] &&         zend_hash_find(z_arrval_p(pg(http_globals)[track_vars_server]), "http_referer", sizeof("http_referer"), (void **) &data) == success &&         z_type_pp(data) == is_string &&         z_strlen_pp(data) != 0 &&         strstr(z_strval_pp(data), ps(extern_referer_chk)) == null ) {     efree(ps(id));     ps(id) = null;     ps(send_cookie) = 1;     if (ps(use_trans_sid) && !ps(use_only_cookies)) {         ps(apply_trans_sid) = 1;     } } 

the check http header "http_referer", know can faked, "security through obscurity". safe method use session_save_path or use database session handler.

to set session_save_path in php.ini, should find more information here http://php.net/manual/en/session.configuration.php.

or, if php running apache module, can configure in htaccess file of vhost container:

php_value session.save_path "path" 

or better phpinidir per vhost:

<virtualhost ip> [...] phpinidir /var/www/... [...] </virtualhost> 

update [panique]:

i'm adding full solution answer, might other people too. sample full vhost setup:

<virtualhost *:81>     documentroot /var/www/xxx1     <directory "/var/www/xxx1">         allowoverride         php_value session.save_path "/var/mysessionforproject_1"    </directory> </virtualhost>  <virtualhost *:82>     documentroot /var/www/xxx2     <directory "/var/www/xxx2">         allowoverride         php_value session.save_path "/var/mysessionforproject_2"    </directory> </virtualhost>