PHP-如何将当前会话ID告知下一个服务器请求？

Question

I'm having a big trouble here: In my company we have a huge system and too many people access it every day. We are having the following problem:

1. User access his account on the pc A.
2. He goes to write his text
3. He write all his text but doesn't save it. Then open a new tab.
4. In the new tab, he access the account of his customer.
5. Using the account of his customer, he goes to write the customer's text.
6. After type the customer's text, he goes to the previous tab to save his own text and after save the customer text.
7. The two texts appears on the customer's page.

I was thinking in a way of the current screen store somewhere the actual session id, and then when the user click in a link, or post a form, the current page send the session id loaded when it was rendered to the requested page.

Can you help me please?

Thanks!

Answer 1

Its a little difficult to follow the use case specified, but it sounds like you need to check access rights to save 'text' to a particular account.

at the moment it appears that your authenticated customer account is saving to an account that isnt theirs?

for eg, in the new text method, before anything happens:

if($currentUserID != $accountOwnerID)
{
     // throw a 403 exception here
}

this way if they happen to change identity during a session, their access rights will always be checked before anything else can happen.

Answer 2

The best solution is to use named sessions. See: session_name()

By using it, you can have different (and isolated) sessions which will not conflict to each other, even if in the same computer, same browser.

For your particular case, I would create a session named after the user logon, which is unique. That way, if user A logs in, he will have his own session. If a new tab is opened, and he logs as user B, a different session will be created, and both tabs will work simultaneously and correctly, each on it's own session space.

Just add session_name($UserLogon); before session_start() , should work good.

Answer 3

You can use session keys to check.

For that first you need to create a random session key and store it in a session variable. Also provide this value as a hidden element in your form. During the insertion you can check whether the value in hidden element is same as the session key, then insert. Else through error message. After successful insertion reset the session key again. It will overcome your problem.

Hope it helps.