This has been asked a bunch of times. I am just curious to see if the below code provides a fairly significant level of security.
Are there any other cases I should consider?
Below is just an example; please ignore any syntax problems; I'm looking for insight into the security aspect of the code.
Few assumptions:
- If user does nothing in 5 seconds, log him out.
- If user is not coming from somePage.php log him out.
- If users ip address changes, log him out.
Code:
<?php
session_start();
$time = time();
$ip = $_SERVER['REMOTE_ADDR'];
if ($time - $_SESSION['time'] > 5)
{
//function to log out user...//echo "logged Out,Time";
}
elseif ($ip !== $_SESSION['ip'])
{
//function to log out user...//echo "logged out,IP";
}
elseif ($_SERVER['HTTP_REFERER'] !== "http://server.com/somePage.php")
{
//function to log out user...//echo "logged out,Refer";
}
else
{
//do sensitive stuff
}
$_SESSION['time'] = $time;
$_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
?>