PHP MySQL - Stilson.net

www.it-ebooks.infoCHAPTER 18 • SESSION HANDLERSsession.cookie_lifetime = integerThe lifetime is specified in seconds, so if the cookie should live 1 hour, this directive should be set to3600. If this directive is set to 0 (the default), the cookie will live until the browser is restarted.Setting the Session Cookie’s Valid URL PathThe directive session.cookie_path determines the path in which the cookie is considered valid. Thecookie is also valid for all child directories falling under this path. Its prototype follows:session.cookie_path = stringFor example, if it is set to / (the default), then the cookie will be valid for the entire web site. Settingit to /books means that the cookie is valid only when called from within the http://www.example.com/books/ path.Setting the Session Cookie’s Valid DomainThe directive session.cookie_domain determines the domain for which the cookie is valid. Neglecting toset this cookie will result in the cookie’s domain being set to the host name of the server which generatedit. Its prototype follows:session.cookie_domain = stringThe following example illustrates its use:session.cookie_domain = www.example.comIf you’d like a session to be made available for site subdomains, say customers. example.com,intranet.example.com, and www2.example.com, set this directive like this:session.cookie_domain = .example.comValidating Sessions Using a RefererUsing URL rewriting as the means for propagating session IDs opens up the possibility that a particularsession state could be viewed by numerous individuals simply by copying and disseminating a URL. Thesession.referer_check directive lessens this possibility by specifying a substring that each referrer isvalidated against. If the referrer does not contain this substring, the SID will be invalidated. Its prototypefollows:session.referer_check = stringSetting Caching Directions for Session-Enabled PagesWhen working with sessions, you may want to exert greater control over how session-enabled pages arecached by the user’s browser and by any proxies residing between the server and user. The371