Should we create our own session ids?

Hello Everyone,


How about rolling our own session ids?

Why? it would be better to do so in order to work with cross-domains, domain aliases and multiple sub folder installations.

For exmaple:

www.mydomain.com and shop.mydomain.com all point the same modx installtion but the domain is different.

If we were to use the $base_path + $site_id + user's ip address we could create a unique session id for that user.

With this id it does not matter which domain the user is using as long as they are using the same modx installation.

This will also solve multiple sub folder installations of modx.

The question is, will this id be secure and unique? IMO yes! Who will know your base_path and site_id settings? If someone does then they will also know your datbase password, etc

The system is as secure as your config.inc.php file is secure

What do you think?

I'm all for it. I think we definitely need to deal better with multiple install situations.

And the session timeout issue. I used a .htaccess file entry to change the session file location to a folder in the client's space, instead of using the generic public /tmp directory, and added a stale session file cleanup processor/menu item to Manager to clear them out; it's not a busy site and I haven't decided on what to hook an automatic gc function to yet. Improves security as well for shared hosting sites.

Susan, this sounds like something that should probably be incorporated to the main distribution... want to toss it in for us, using your fancy Eclipse SVN tools, of course

Thanks!

Problem is, .htaccess only works on *nix systems, and that means a problem with Win servers. It should be in the code; I'm just not sure at this point where, and it should be an automatic gc system.

I'm working on multilanguage front end and a graphical user tracking system (sorry...my partner's orders get precedence); once I get those working I'll be able to dig into this some more.

Problem is, .htaccess only works on *nix systems, and that means a problem with Win servers. It should be in the code; I'm just not sure at this point where, and it should be an automatic gc system.

I'm working on multilanguage front end and a graphical user tracking system (sorry...my partner's orders get precedence); once I get those working I'll be able to dig into this some more.

This is not completely true regarding .htaccess files. I use these on Windows XP with Apache all the time -- all that has to be done is changing the name of the access file in the Apache config -- though I'm not sure how most shared Windows hosting providers handle this, or how it might work in IIS (yuck), if they use it instead of Apache. For instance, for my local friendly URL testing, I use the filename ht.access, then simply rename it when I upload to a shared Unix server.

My point exactly. For this to work in ALL servers, including IIS, BadBlue, or whatever (I kinda like Bad Blue when I have to work on Windows), this session stuff should be in the scripts somewhere. Maybe in config.inc.php...that gets included into just about everything that makes a page as far as I've been able to see.