PEAR auth package - how does setSessionname work?

I have used the PEAR Auth package to successfully set up authentication.


<code>
// Details of where the authentication details are stored.
$options = array(
'dsn' => "pgsql://graphicomm2:pw@localhost/graphicomm2",
'table' => "v_active_users",
'usernamecol' => "f_email",
'passwordcol' => "f_password",
);
$a = new Auth("MDB2", $options, "loginFunction");
$a->setSessionname("GCERP");
$a->start();
</code>

However, this does not seem to change the session name in the browser when I
check the cookies.

But -but - but - it does work in the sense that I can log in to two
different php applications from different tabs on the same browser and the
authentication is separate. I.e. if I am logged into one app it does not
mean that I am allowed to access the second app.

The problem I have is that $_SESSION variables seem to be cross
application!?! I.e. if I use a $_SESSION variable it can be accessed from
either application.

Now I know I can uniquely name the $_SESSION variables which will probably
be the interim solution but I would have thought that there would be a way
of limiting $_SESSION variables to that particular session as set by the
setSessionname.

Any thoughts - thanks,

Kevin

.

Relevant Pages

  • Re: Problem with Session Variable
    ... Check out the authentication part of your web ... You can get a first impression by reading ... User A signs in and the screen shows that the userid is "User A". ... > session variables in the Session_start event is loopy! ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: When exactly are you logged in? (Forms authentication)
    ... Actually, I think you can, eg using the mobile internet stuff ... FormsAuthentication doesn't let you just redirect with the authentication ... and checking for it in the global.asax "Global_AcquireRequestState" handler ... The 'cost' would be two session variables per user - ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: logging off (without getting page when click on back )
    ... If you are using Forms Authentication, ... Auth use so a new session will be started whenever ... If you are relying on session variables only, ... very secure mechanism to handle authentication. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: lack of understanding of principals, identities, and context
    ... Other thing when it is used would be when you use role-based authentication. ... checked if Request.IsAuthenticated=true (login cookie exists in case Forms ... >> HttpContext is request specific and ... > It would not be too heavy (only involving two or three session variables, ...
    (microsoft.public.dotnet.framework.aspnet.security)