php - Close session and start a new one -


i'm testing implementation of security check in php sessions. can successfuly detect whether session started ip address , can start new session. however, data old session gets copied new one! how can start blank session while preserving previous session data legitimate owner?

this code far, after lots of failed attempts:

<?php  // security check if( isset($_session['ip_address']) && $_server['remote_addr']!=$_session['ip_address'] ){     // check failed: we'll start brand new session     session_regenerate_id(false);     $tmp = session_id();     session_write_close();     unset($_session);     session_id($tmp);     session_start(); }  // first time here if( !isset($_session['ip_address']) ){     $_session['ip_address'] = $_server['remote_addr'];     $_session['start_date'] = new datetime; } 

the official documentation sessions terribly confusing :(

update: i'm posting findings got through trial , error. seem work:

<?php  // load session discard session_start();  // can generate new id open session session_regenerate_id();  // store id because gets lost when closing session $tmp = session_id();  // close session (doesn't destroy data: $_session , file remains) session_destroy();  // set new id next session session_id($tmp); unset($tmp);  // start session (uses new id, removes values $_session , loads new ones if applicable) session_start(); 

just call session_unset after session_regenerate_id reset $_session current session:

if (isset($_session['ip_address']) && $_server['remote_addr']!=$_session['ip_address']) {     // check failed: we'll start brand new session     session_regenerate_id(false);     session_unset(); } 

Comments

Popular posts from this blog

Add email recipient to all new Trac tickets -

400 Bad Request on Apache/PHP AddHandler wrapper -

php - Change action and image src url's with jQuery -