Home/ Questions/Q 8944055
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-15T11:56:27+00:00

Although it probably doesn’t happen often, it could happen that UserA is logged in

  • 0

Although it probably doesn’t happen often, it could happen that UserA is logged in and has an active session. Then UserB picks up the laptop and wants to use the same site. In PHP is it possible to test for this and allow this or is it one user per session.

The example I ran into is while testing I had userA logged in to their profile, then for userB I clicked a link to reset their password, but instead of hitting the password reset page I was redirected to the profile page for userA. This is the way I coded it, but I wondering if these days with family using on laptop for everyone should I devise a way to give each person their own session for cases like the email link?

Edit: I’ve decided to abandon this idea altogether. I’ll leave it up to the user to secure their session.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I’m just posting this to show how it could be possible, but I STRONGLY suggest you never ever even try to use this technique. It opens up entire worlds of security problems, and any minor convenience you could offer your users will be absolutely annihilated by the problems it causes.

    That being said, you can use PHP’s trans_sid (“transparent session ID”) support, where the session ID is automatically embedded into URLs and as hidden form fields. This would allow you to open multiple windows, each with its own session, with no sharing betweeen the windows.

    Basically you’d turn off cookie-based sessions and use ONLY the transparent IDs: PHP will automatically modify <a href="..."> to add in the session ID parameter into query strings, and insert hidden form fields as needed. It will not work on JS code and the like, but you can add in the ID yourself there.

    However, here’s the problem: Now that session ID is embedded in the URLs and forms, bookmarking a page on your site will tie that bookmark to the particular session in use at the time. Cut ‘n pasting a url to share something will also transmit the user’s session to whoever they send the link to. Clicking on any links to the outside world from your site will transmit the session ID as part of the referer. e.g. you’ve just made session hijacking utterly trivial, because the user will be yelling their session ID from the rooftops everytime they do anything.

    simpler solution: Use the browser’s “porn mode” so each window has its own cookie storage, separating each user’s window/session from the others.

    • 0