$site_sessionname ?

Hi,

I found this variable at line 14 of typical MODx config file



Do we change it to custom one ?

regards,

zi

You can but you don’t have to. Each new installation (or upgrade from previous installs with $site_sessionname) will be given a unqiue session name. This is to allow multiple installs on the same domain.

Thanks Raymond !

It means that changing this would cause problem in long run !

regards,

zi

Quote from: zi at Aug 29, 2005, 12:08 PM

Thanks Raymond !

It means that changing this would cause problem in long run !

regards,

zi

Not really. It would mean that you would just have to maintain a unique name throughout the domain.

hmm.. now it clears !

That’s great !

Thanks Raymond

regards,

zi

Dumb question: why isn’t this based on the $site_id set during install?

We could have use the $site_id as the $site_sessionname but the $site_id is already used as part of the encryption phrase for creating the cookie strings. See accesscontrol.inc.php.

Right, but if we did something similiar in startCMSSession:



We can have it use $site_id as part of the session name without compromising the security of the cookie encryption.

Quote from: infoclipper at Aug 29, 2005, 04:03 PM

Right, but if we did something similiar in startCMSSession:

session_name(substr(md5("user" . $site_id),0,12));

We can have it use $site_id as part of the session name without compromising the security of the cookie encryption.

You’re correct. I did thought about that but then I thought about the additional over head that would be created by the MD5 function on every include. So I decided to run with the static id which could be easily changed without the user having to alter the $site_id.

Wouldn’t the MD5 overhead only be incurred once when the session was started? As in not that much overhead unless you have a billion user logins per hour...