Question about session w IE set to "Block All Cookies" 1

[john99999]

If all Block All Cookies in IE is disabled, will sessions work?

I cant seem to get IE to accept my session variable if Privacy is set to "Block All Cookies" (this highest setting), does this also block php session variable?

If Privacy is set to high the session variables work and if i use a custom setting "Block all 1st party cookies, block all 3rd party cookies, allow session cookies" it works.

Can anyone confirm or deny that session variables will work if "Block All Cookies" is set in IE? A session variable isn't a cookie is it? Where are session variables actually stored?

 

[sleipnir214]

By default, PHP stores the ID of each session in a cookie on the browser. If your browser is set to deny all cookies, then the session ID cookie cannot be created, and sessions by cookie will fail.

It is also possible, however, to use PHP sessions through the setting of the session ID on the URL or within forms. AS the PHP online manual main page on session handling points out:

URL based session management has additional security risks compared to cookie based session management. Users may send a URL that contains an active session ID to their friends by email or users may save a URL that contains a session ID to their bookmarks and access your site with the same session ID always, for example.


Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[DRJ478]

1. Only of you use transparent SID, i.e. all links will be populated with the session ID as a GET variable in the URL.

2. If sessions are based on the SID to be transferred by a cookie (which is most common) then PHP sessions will also be blocked.

3. no comment

4. Cookie based sessions will not work with that setting. Only transparent SID will work. Read in the PHP manual about the security implications raised by transparent SID.

Session variables are not cookies. The session vars are stored on the server. The cookie is only used to transfer the session ID to the server so it can retrieve the stored session data.

 

[john99999]

Is there any other way to do it?

I've seen sessions written to the /tmp directory on the server before, would that work?

 

[sleipnir214]

All session-use writes files to the /tmp directory. That's where PHP stores the actual data.

(That's not actually true. The data can, through script intervention, put the data anywhere. I have a FAQ here about using MySQL as the store for session data.)

Only the session ID is stored in the URL or the cookie. But cookie or URL are the only ways I know of.



Want the best answers? Ask the best questions!

TANSTAAFL!!