Re: Been Gone Way Too Long
M@rcel <[email protected]>
| Newsgroups | gmane.comp.web.oscommerce.devel |
|---|---|
| Message-ID | <f29a6178c6eeead9f2c01ed1e198bfa1@osCommerce-Forums> |
This message was sent from: Development http://forums.oscommerce.com/viewtopic.php?p=164484#164484 ---------------------------------------------------------------- [quote="NorthStar"]Because this way if an unscrupulous website or host does get the cookie off the customer's browser he will have only 20 minutes (or less) to hijack a session.[/quote]I understand your fear of sessions being hyacked. I wonder, however, how the scenario from the quote would take place. Can you give a practical example of how a malicious site could fetch the osc-cookie? The lifetime of the sessioncookie is set to end-of-session. This means that the cookie is destroyed as soon as the last browserwindow is closed. A cookie will never live shorter than this. Even when the lifetime of a cookie is set to 10 min. it will not be deleted until the current browser-session ends. If you really want to limit php-session-life, you should set the session-timeout-value in php.ini to a lower value. As far as I know it's default is 1440 secs or 24 minutes. This is pretty close to the 20 minutes you would like to see.