This seems to offer no added benefit for anonymous users, since all the setting and checking is done against logged in users.

What about anon users who are able to use shopping carts, et. al.?

Comments

grendzy’s picture

grendzy commented
Status: Active » Postponed (maintainer needs more info)

Interesting idea. It might be possible; I think the approach would be to regenerate the session the first time an SSL page is visited. That way the old session becomes invalid, and the new session is protected.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

Or simply set a cookie on first visit for all users (using hook_boot()), and reset that cookie if people login. The issue is that the cookie setting only happens during hook_user($op == 'login');

grendzy’s picture

grendzy commented

I thought about that, but I was worried that would create an endless loop for user agents that refuse the cookie, because you'd need to redirect to an SSL page to regenerate the session and set the secure cookie.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

I just ran into that issue, actually, and for those users ended up setting a pseudo-global in a static variable.

But for users who don't accept cookies, session tokens are meaningless anyway...

To avoid the endless loop, you can also check for isset($_COOKIE[session_name()]), and if it fails, skip your routine (or exit to e massage telling people they must have cookies enabled.

damienmckenna’s picture

damienmckenna
Location TN, USA
commented

Subscribe.