losing session data with cross-site scripting

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hey folks -

I have a php site on a production server. The production server doesn't have the spell libraries, and rather than migrate the site, we setup spell checking functions on the development site, and shuttled the users back and forth with specially crafted get links and forms.

The POST form or GET link on the production site contains the string to be spellchecked. Once the user is at the development site, the string is spellcheck, and corrected if necessary. The development site checks the http referrer to make sure it's not just anybody, and the only thing it does is spell checking, anyway.

After the spell checking is done, we then create links that bring the user back to the development site. On the development site, I have an include at the beginning of each page that checks for a session, and either takes them to the proper page, or throws an error if they are not on the login page and have no session.


Most of the time, no problem. When a user is returning from the production site, their session is still set when they load the page on the production server, and they get the appropriate page. However, for a few users, they are somehow losing session data, and they get the error when they try to return from the development server.

What is happening? Is is some kind of security setting on the browser? These are remote users and I can't go and inspect their computers. I will have to communicate by email or phone with them.

Steve Lfevre

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux