Cita:
Iniciado por JAK^ en todos los casos coloca <? session_start();?> solo, antes ke todo antes de cualuier cosasea php o html. bueno supongo ke si estas trabajando con cookies tenes habilitadas a estas para no tener este problema trabaja con get
<?
ini_set("session.use_cookies","0");
ini_set("session.use_trans_sid","1");
?>
con este codigo desactivas las cokies y activas el envio por get, lo tenes ke poner en todos los scripts ke trabajen con sesion
te kedaria asi
Código PHP:
<? session_start();?>
<?
ini_set("session.use_cookies","0");
ini_set("session.use_trans_sid","1");
?>
pon ese fragmento antes ke toodo
NO NO .. no propaguen el SID en el URL por favor .. No lo digo yo .. lo recomienda por seguridad PHP.net en este documento de lectura obligada:
Cita: Sessions and security
External links: Session fixation
The session module cannot guarantee that the information you store in a session is only viewed by the user who created the session. You need to take additional measures to actively protect the integrity of the session, depending on the value associated with it.
Assess the importance of the data carried by your sessions and deploy additional protections -- this usually comes at a price, reduced convenience for the user. For example, if you want to protect users from simple social engineering tactics, you need to enable session.use_only_cookies. In that case, cookies must be enabled unconditionally on the user side, or sessions will not work.
There are several ways to leak an existing session id to third parties. A leaked session id enables the third party to access all resources which are associated with a specific id. First, URLs carrying session ids. If you link to an external site, the URL including the session id might be stored in the external site's referrer logs. Second, a more active attacker might listen to your network traffic. If it is not encrypted, session ids will flow in plain text over the network. The solution here is to implement SSL on your server and make it mandatory for users.
http://www.acros.si/papers/session_fixation.pdf
Fuerza la propagación del SID en cookies y asegurate de que ningún antivirus, navegador (configuración de nivel de seguridad) y otros dispositivos de ese estilo bloqueen las cookies que PHP va a emitir para propagar el SID:
Código PHP:
ini_set("session.use_cookies","1");
ini_set("session.use_only_cookies","1");
ini_set("session.use_trans_sid","0");
Un saludo,