Lets just consider the trust that the server have with the user.
Session fixation: To avoid the fixation I use session_regenerate_id() ONLY in authentication (login.php)
Session sidejacking: SSL encryption for the entire site.
Am I safe ?
11
votes
What sort of site is it?
- delete me
@MrXexxed a site where the developers don't want it to be hacked.
- rook
@The Rook, I was speaking to the OP, it was a genuine question, your comment is both facetious and entirely unhelpful.
- delete me
@delete me Why does it matter? People need to protect their users from attacks like session hijacking. Its sad that most developers don't care or don't know to stop such attacks.
- rook
possible duplicate of PHP Session Security, What is the best way to prevent session hijacking?
- outis
3 Answers
28
votes
Read OWASP A3-Broken Authentication and Session Management. Also read about OWASP A5-CSRF, which is sometimes called "session riding".
You should use this code in a php header file:
ini_set('session.cookie_secure',1);
ini_set('session.cookie_httponly',1);
ini_set('session.use_only_cookies',1);
session_start();
This code prevents session fixation. It also helps protect against xss from access document.cookie which is one way that Session Hijacking can occur. Enforcing HTTPS only cookies is a good way of addressing OWASP A9-Insufficient Transport Layer Protection. This way of using HTTPS is sometimes called "secure cookies", which is a terrible name for it. Also STS is a very cool security feature, but not all browsers support it (yet).
2
votes
I would also suggest storing the user agent and ip information in the session, and verifying it on each request. It's not bullet-proof, but it is a fairly significant increase in robustness. While UA forging is really easy, IP forging, while possible, is MUCH harder... But you may have issues with users who are behind a round-robin IP system such as AOL users...
0
votes
the best practice i have ever found is save the session data to database or a text file. the database will have user agent, and IP record and check it every request for ensure that the session never been hijacked by other.
for example how session saved at database you can see the implementation at codeigntier session library. in my opinion this way fairly save to prevent someone to hijact session.
