You are welcome Kevin, I am also discussing it with you what is in my mind :) As per my knowledge on session_destroy() php deletes session file itself. Or if some time has been passed it will delete itself example 25 mins of inactive (this is default behavior of php)

Apologies I didn't realise, thought Soft24 were just for the Premium users.

Ok, the password attempts and brute force thing can be solved with a component - so if I ever get brave enough and knowledgable enough I might have a stab at that if nobody beats me to it.

I think with the session ID thing, a simple fix (though not foolproof) is if OSSN deleted that session file on the server when somebody logs out.

That way it couldn't be used anywhere else.

I'm just playing devil's advocate here, but securing an app doesn't stop at assuming people are in a safe environment. There are all sorts of ways of attackers getting access to your session files, which could be from emails, rogue websites, malware etc.

Somebody could log on to a public computer anywhere in the world (clubs, libraries, schools ) and forget to logout - thinking just closing the browser is enough. The next person opening the browser on the public machine would be able to log straight back in to the site if they are within the expiry window. Admitedly thats pretty stupid, but if you bear in mind that the majority of people actually using the sites are non-techies, its more about doing what we can to protect the end users.

I didnt copy any headers or files... I simply placed the session ID number into the value of the cookie.

You could update the timestamp somewhere every time a validated request is performed, so if a timestamp comes in thats older - that can be rejected too.

Again, I actually really like OSSN and think its a brilliant system. I'm just trying to help improve it, or at least offer suggestions.

And HTTPS goes without saying - you'd have to be stupid to run something like this without it! :D

All security stuff should be discussed on our contact page. Ok since it is not critical so I am leaving it here for discussion.

Failure attempts block can still be created using component. ....

This session stuff, if you generate your own session id and place it in as PHPSESSID it still useless , you can still copy that ID and place in other browser with same version, name , headers it will still make you loggedin. The other case if someone steals is is if someone takes your session that means your computer is hacked :) You should use HTTPS.

Your answer can be found here: https://stackoverflow.com/questions/4017344/is-https-the-only-defense-against-session-hijacking-in-an-open-network