Bug #9856

cookie set everytime new Auth() is called

Details

Submitted	2007-01-17 19:15 UTC
From	mandric at gmail dot com
Status	Bogus
Package	Auth
PHP Version	5.1.4
OS	Mac OS X
Roadmaps	(Not assigned)

Comments

[2007-01-17 19:15 UTC] mandric at gmail dot com

Description:
------------
Auth sets an authchallenge cookie every time the object is initialized.

I was including auth.inc on every page and hence doing
$auth = new Auth("DB", $db_options, "loginFunction");
on every page.

I figure Auth should act differently?

[2007-02-02 00:25 UTC] aashley at php dot net

Thank you for taking the time to write to us, but this is not
a bug.

Auth regenerates the session id on every request so as to minimise the chances of a session high jacking. Doing this will cause a new cookie to be set on every page.

In addition with advancedSecurity enabled a challenge-response cookie is also set on every request.