are PHP auto-generated Session ID's locked on IP address?

315 Views Asked by At

I read on a other Stackoverflow article that Session ID's in PHP are generated based on:

  1. IP address of the client
  2. Current time
  3. PHP Linear Congruence Generator - a pseudo random number generator (PRNG)
  4. OS-specific random source - if the OS has a random source available (e.g. /dev/urandom)

I could not find an awnser on the web to the question if these Session ID's are only usable with the IP used in the generation.

Seems most likely to me, but can anyone confirm?

1

There are 1 best solutions below

0
On BEST ANSWER

No, they definitely aren't "locked" to the IP address. For many users that wouldn't work as their web traffic goes through proxies and such so their IP address may be different to the server for each separate request.