PHPSESSID in bookmark

[elck]

People often copy url's from the addressbar.
Sometimes (mostly the second page that is called in a session) PHP adds PHPSESSID's to any link on a page.
ex:

http://www .site.com/in.php?s=1&PHPSESSID=08313af2e3a45a3317fd917704ceecc7

Suppose I detect this in javascript and then reload the page. It would get rid of the ID, but what would happen if someone has turned off cookies etc.?

It does not seem a save way.
Does anyone have experiences or knows of another way?

 

[sleipnir214]

PHP will add session IDs to URLs only if allowed to do so. This behavior is set by session.use_cookies, session.use_trans_sid and session.use_only_cookies. You likely will not have to strip off anything in JavaScript if you reconfigure PHP.


The only way to implement sessions is to transmit a session identifier around. There are only three possible ways to do hand off that identifier: on the URL (GET method), in a field of a POST-method form (POST method) and via cookies (cookie method).

All three methods expose the identifier in some way or another. It's just that GET method makes the identifier the most readily visible.


Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[elck]

In

http://bugs.php.net/bug.php?id=24693

it states, as far as I understand, that there is no way to change session.use_trans_sid once the file started. A bug that was fixed in php5 (which I do not have)

I tried your suggestions and it did not work.

<?php
ini_set('session.use_cookies',"1"); 
ini_set('session.use_only_cookies',"1"); 
ini_set('session.use_trans_sid',"1"); 


session_start();

 

[sleipnir214]

I take it, then, that you do not have access to your php.ini?


Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[elck]

That is so, Sleipnir.

 

[sleipnir214]

Actually, now that I think about it, shouldn't this:

ini_set('session.use_trans_sid',"1");

be this:

ini_set('session.use_trans_sid',"0");

? Not that it will matter, of course, if you're running a verion of PHP affected by the bug. But the bug report you mention stated that the affected version was 4.3.2, and there are versions of PHP between that one and 5.0, and those versions will be fixed, too.


Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[elck]

Yep, my version is 4.3.1 and I tried both "0" and "1"
so it seems I'm back to the original question.

Anyone ever tried to get around the bug with javascript?