Databases
StackOverflow2013
Postsdbo
POSession hijacking prevention...how far will my script get me? additional prevention procedures?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POSession hijacking prevention...how far will my script get me? additional prevention procedures?
    primarykey
    data
    text
    <p>When the user logs in the current session vairables are set</p> <pre><code>$_SESSION['user']['timeout'] = time(); $_SESSION['user']['ip'] = $_SERVER['REMOTE_ADDR']; $_SESSION['user']['agent'] = $_SERVER['HTTP_USER_AGENT']; </code></pre> <p>In my common.php page (required on ALL php pages) i have used the below script, which resets a 15 minute timer each time the user is active furhtermore checks the IP address and checks the user_agent, if they do not match that as of when they first logged in/when the session was first set, the session is unset furthermore with inactivity of up to 15 minutes the session is also unset. </p> <p>... is what i have done a good method for preventing session hijacking furthermore is it secure and or is it enough? If not what more can be done?</p> <pre><code>if(!empty($_SESSION['user'])){ if ($_SESSION['user']['timeout'] + 15 * 60 &lt; time()) { unset($_SESSION['user']); } else { $_SESSION['user']['timeout'] = time(); if($_SESSION['user']['ip'] != $_SERVER['REMOTE_ADDR']){ unset($_SESSION['user']); } if($_SESSION['user']['agent'] != $_SERVER['HTTP_USER_AGENT']){ unset($_SESSION['user']); } } } </code></pre>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. This table or related slice is empty.
    1. USYusaf Khaliq
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POSession hijacking prevention...how far will my script get me? additional prevention procedures?
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POSession hijacking prevention...how far will my script get me? additional prevention procedures?
      1. USBlender
      1. VTFavorite
    1. COunless you are a bank don't over extend your self
      singulars
      1. POSession hijacking prevention...how far will my script get me? additional prevention procedures?
      1. USdynamic
    2. CO:) ... I understand you, but you may have heard the saying "you can never be too safe", If i am taking that too far please explain how.. please ?
      singulars
      1. POSession hijacking prevention...how far will my script get me? additional prevention procedures?
      1. USYusaf Khaliq
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload