Web Hosting Talk






PDA

View Full Version : PHPSESSID

ryan14
07-29-2009, 04:20 AM
I want to use PHPSESSID for my php forum for user logins, user forum posts and for everything. I do not want to use cookies. I want sessions ID's stored in the URL. I don't want any cookies stored on the clients PC.
So a person could login and post in my php forum even when Cookies are disabled in their web browser.

Are there any security risks with using sessions rather than cookies and how can I set the sessions to expire when the user closes their web browser?
mwatkins
07-29-2009, 12:13 PM
You do need to remain aware of security and SEO issues. Here are a few articles / discussions on-line as a starter:

http://kb2.adobe.com/cps/172/tn_17255.html
http://stackoverflow.com/questions/139238/session-id-in-url-and-or-cookie
http://www.searchengineguide.com/stoney-degeyter/why-session-ids-and-search-engines-dont.php

Are you wanting to use URL query params rather than cookies because some folks disable cookies? If so, then the second part of your quest - detecting a browser close - is probably going to be fruitless. Many folks that disable cookies are also going to disable javascript, and some in-client scripting mechanism is a pre-requisite for detecting browser events.

I've adopted jquery for most of my client-side javascript needs - here's an example detecting browser (or tab) close - I've not tested this across all browsers but it certainly works in Firefox.

<html>
<head>
<script type="text/javascript" src="jquery.js"></script>
<script type="text/javascript">
$(document).ready(function() {
alert("Hello world!");
jQuery(window).unload(function(e) {
alert("Goodbye, cruel world, I'm leaving you today.");
});
});
</script>
</head>
<body>
<p>jquery example showing <code>.unload</code> method.</p>
</body>
</html>
mwatkins
07-29-2009, 12:33 PM
Re the above, your javascript could (via xmlhttprequest / aka ajax) call a page/method from your site which purges their session.

Example with cookie setting in case you change your mind about cookies:

<html>
<head>
<script type="text/javascript" src="jquery.js"></script>
<script type="text/javascript" src="Plugins/jquery.cookie.js"></script>
<script type="text/javascript">
$(document).ready(function() {
alert("Hello world!");
// set a cookie on visit, expires 1 day
jQuery.cookie('cruelworld', 'shazam', { expires: 1 });
jQuery(window).unload(function(e) {
alert("goodbye world!");
// unconditionally delete cookie on browser close
jQuery.cookie('cruelworld', null);
});
});
</script>
</head>
<body>
<p>jquery example showing <code>.unload</code> method.</p>
</body>
</html>

You'll need the jquery cookie plug in (http://plugins.jquery.com/project/Cookie) for the above to function.