#1 Real session management is missing - Security hole

[Stefan Diener]

A real session management is missing. There is a single
session at this time and no second user is able to
start a new session as long as the first session is
active.

Furthermore there is a security hole. If User1 starts
a session and his session timeout is reached (10 minutes),
his session will be closed. Unfortunately his Web
browser does not recognize this, so the current page
will be displayed until death. Now User2 may start
his session and work on the system. If User1 wakes up
and continues, there is no way to detect that his session
was already cancelled. User1 is able to work is usual.
In fact there are 2 users in the system at the same time.
This is very dangerous!

The solution is to implement a real session management,
so that each session uses its unique session ID.