0

Is it possible for a webserver to assign a PHPSESSID currently used by another client at the moment of attribution?

Or a check is made before attribution ?

Duke Nukem
  • 319
  • 4
  • 15
  • 1
    I am little confused by your question. Are you asking if its possible for PHP to assign the same PHPSESSID to multiple clients? – Scott Jun 28 '16 at 14:37
  • 1
    Most likely this is possible - During a quick look at the code at github I didn't notice any checks to prevent this. However the session id is pretty long which means the odds of this happening are very very small. – user254948 Jun 28 '16 at 14:50

2 Answers2

0

This ID is generated automatically when you make a session_start.

 session_start();

If you know some ID you can force to assign that to another instance/client, but in my opinion that could be a security risk, I don't recommend you to do that.

Willem Franco
  • 854
  • 9
  • 7
0

Follow logic should work theoretically:

  1. Close and save current

    session_write_close();

  2. Set new session ID

    session_id(YOUR_SESSION_ID_HERE);

  3. Run new session

    session_start();

Rinat
  • 429
  • 5
  • 14