Appendix H: Duplicate and Concurrent sessions

You should be aware that it is possible for a user to create multiple browser instances on his client device. For example, using 'Ctrl+N' within Internet Explorer will produce a new browser instance which is an exact copy or 'clone', including history, of the current instance. These clones will all share the same session cookie, the same session name, the same session id and therefore the same session data on the server. This can have confusing results if the same script is accessed in different browser instances at the same time as only one set of session data for that script will be maintained on the server, therefore only the latest activity will be recorded regardless of the browser instance in which the activity took place.

The only way to avoid this behaviour is to have a mechanism which will assign a separate session id to a particular browser instance, thereby allowing the server to maintain separate session data for each instance. This mechanism must do more than simply use the session_regenerate_id() function to create a new session id as this will simply overwrite the exsiting session id in the session cookie, therefore all browser instances which access this cookie will simply switch from sharing the 'old' session id to sharing the 'new' one.

In Appendix G I stated that the session cookie contains data in the format <session_name>=<session_id>, which means that the only way to have multiple session id's in the same cookie data is to give each one a separate name, as in:

<session_name1>=<session_id1>
<session_name2>=<session_id2>
<session_name3>=<session_id3>

Within my menu system I am able to generate new session names, and hence separate session id's with their own session data, with the following steps:

• I change the session name from the default PHPSESSID to MENU. This can be done in either of the following ways:
  • Use the ini_set() function to change the session.name configuration option before using the session_start() function.
  • Create an Apache .htaccess file with the directive php_value session.name xxxx.
  This immediately keeps the menu session data totally separate from other systems.
• By selecting the 'new session' link in the menu bar the server will generate a new session name with a new session id, and re-issue the current page with that session name. The new session will start with a copy of the previous session data, but as the previous (original) and new (cloned) browser instances now have different session names the server will be able to keep their session data separate.
• New session names are formulated by iterating from 'menu0' to 'menu99' until one is found which does not exist in the $_COOKIE array.
• Whenever the user passes through the logon screen the system will automatically generate a new session name, thus keeping data for the new session completely separate from any existing session(s).

The user now has the option to let multiple browser instances share the same session data, or to force an instance to maintain separate session data simply by selecting the 'new session' link in the menu bar.

This functionality is explained in more detail in Client Clones and Server Sessions.