high renews the session every request, giving the stored values a new
session id. This makes it extremely hard to highjack session data. The
consequence is that if something is changed your sessions may stop
working. Setting to medium stops the renew functionality. This leaves
you slightly more vulnerable, but if you are taking other appropriate
precautions to prevent session highjacking then you should be fine.
Try clearing all your previous session cookies. Maybe change the
Session.save to 'cake'.
Leave Security.level high.
On Nov 9, 9:17 am, SiVA_ <[EMAIL PROTECTED]> wrote:
> This isn't the full story. Changing the cookie name only works for a
> few seconds, then the session is destroyed again.
>
> IN this file: libs/session.php , in function __startSession(), there
> is:
> if (Configure::read('Security.level') === 'high') {
> $this->renew();
> }
>
> A temporary fix is to change your security to medium, or comment out
> that line. Not sure of the full impact of commenting that line, but at
> least I'm running again.
>
> On Nov 9, 12:47 pm, SiVA_ <[EMAIL PROTECTED]> wrote:
>
> > This may help others out there with a similar problem:
>
> > I was using an older version of 1.2 alpha (downloaded around August).
>
> > Upgrading to pre-beta caused the acl login system seemed to stop
> > working. After issuing a login, it would redirect back to the login
> > page.
>
> > After digging around, I figured it was something to do with session.
> > So I changed the Session.cookie name in the core, and now my login
> > system works as before.
>
> > Hope someone finds this useful.
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups "Cake
PHP" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at
http://groups.google.com/group/cake-php?hl=en
-~----------~----~----~----~------~----~------~--~---
