Recreate Session = False?

[scytheuk]

Hi, i have been having trouble getting Admin and Customer login to work on my test site, have been talking to 'mprough' who helped me to give the logins working again by setting 'Recreate Sessions' to 'False'

Can someone tell me what exactly this setting will or will not effect?

'mprough' told me i would have the following issues

Implications are that users can "share a session" often logging in as each other and that cart contents are not recreated when a visitor returns.

Yet Cart Contents are recreated, i only have test accounts created so have not seen an issue with people logging in as each other yet

Pete

[kobra]

i have been having trouble getting Admin and Customer login to work on my test site

You did not state where this resides???
If on a local test platform such as ZAMP or WAMP - - do not worry about it
If on a web host then more detail needed

[scytheuk]

Hi Kobra, my apologies, i didnt include the full details of the login problems, as i had originally created a post discussing them.

I created this one as a way of finding more information on the 'Recreate Session' option so as not to have threads that got off topic.

The original post can be found here

http://www.zen-cart.com/forum/showthread.php?t=145648

Pete

[DrByte]

As you said, with Recreate Session set to false, you leave your site open to session hijacking risks -- ie: multiple visitors getting to your site via a common URL containing a zenid, and thus able to see each others' data.

The only oddball hosting company I've seen which requires Session Recreate to be set to False is Dreamhost. And with them, I'm still concerned that session hijacking is a problem.

[scytheuk]

Hi DrByte, thank you for confirming what mprough originally advised.

I guess i shall look into solving this problem so i can turn this setting back on

Pete

[scytheuk]

I am talking to my hosting company about possible problems with my hosting package setup, and i have been asked to find out if there are any particular requirements for the 'Recreate Sessions' to run?

Pete

[scytheuk]

Hi All, just a quick update

In talks with my hosting we establised that the PHP version in use was 4.3.x although they advertised 5.1.x, although zen cart states this is an acceptable version i had them address the issue and get the php updated.

Since the update to 5.1.x we now can re-enable the recreate session option. (I have also noticed a remarkable increase in speed of the site in general)

Pete @ PSL

[mprough]

Were they running PHP 5X as an x Handler maybe? Reason I ask is I have a client in the exact same situation.... wanted to know what I can tell them.

~Melanie

[scytheuk]

If im honest melanie, i have no idea

I originally did not think this was the problem, the option in Zen Cart states it required PHP 4.1 or higher, and as we were on 4.3.6 i thought it would be ok, it was then that i remembered that my host advertised they were running version 5.1.6.

I honestly did not expect this to sort the problem, but wanted it changed to what i was paying for anyway

I contacted service who moved us over night to a new server and this morning i reenabled Recreate Session as a test and everything now works.

Pete

[mprough]

Okay, thanks

~Melanie