Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How secure are PHP sessions?

I'm primarily a C++ programmer, but I'm trying to pick up some PHP.

Apparently the way to implement web user sessions is to store the user's login ID in a cookie using the $_SESSION variable.

Is it not possible for someone to just modify their cookie, to give them different privileges or log in as a different user?

It seems like this authentication mechanism is just having the user store their ID in a file - and then just trusting them not to change it.

Is there something that prevents this?

Thanks!

like image 933
James Avatar asked Apr 15 '12 19:04

James


People also ask

Can PHP sessions be hacked?

Sessions are NOT serverside, they are stored on the clients local machine (you can go in your cookies and look for a cookie called phpssid under your domain name). Yes they can be hacked, and this is in fact a very common method of hacking.

Is PHP session data secure?

“Is a PHP session secure? PHP sessions are only as secure as your application makes them. PHP sessions will allow the client a pseudorandom string (“session ID”) for them to distinguish themselves with, but on the off chance that the string is intercepted by an attacker, the aggressor can imagine to be that client.

Are sessions secure?

Conversations in Session are secured using client-side E2E encryption. Only the sender and the recipient of a message can read it. But Session goes beyond providing message security. Session also protects the identities of its users.

How are login sessions secured PHP?

PHP sessions are only secure as your application makes them. PHP sessions will give the user a pseudorandom string ("session ID") for them to identify themselves with, but if that string is intercepted by an attacker, the attacker can pretend to be that user.


2 Answers

PHP sessions are only secure as your application makes them. PHP sessions will give the user a pseudorandom string ("session ID") for them to identify themselves with, but if that string is intercepted by an attacker, the attacker can pretend to be that user.

What to do

This information is taken from "Session Management Basics" in the PHP manual, but simplified a bit. Some things may have been missed. Be sure to read through that as well.

  1. Always use HTTPS

    • Prevents attackers from reading the session ID cookie
  2. Enable session.use_strict_mode:

    • Rejects uninitialized session IDs
    • Ensures any sessions created are actually valid, so you can trust a prefix (eg, if the prefix is $userId-)
  3. Enable session.use_only_cookies and disable session.use_trans_sid

    • Avoids user sharing session ID accidentally by sharing a URL with the session ID in it
    • Prevents the session ID from appearing in a Referer header
  4. Periodically regenerate the session ID and invalidate old session IDs shortly after regenerating

    • If an attacker uses another user's session ID, regenerating will invalidate either the user's or attacker's session, depending on which makes the request that regenerates the ID. You can then track when someone tries to use a session that has been regenerated already, and invalidate the regenerated session at that point. The user will be able to log in, but the attacker (hopefully) won't be able to.
  5. Optionally keep track of additional information in $_SESSION that relates to the request (IP address, user agent string, etc)

    • If an attacker somehow gains access to a session ID, this can possibly detect the intrusion before the attacker can access any data. However, keep in mind that this may worsen the user experience. For example, the IP address may change when the user switches from a mobile network to Wi-Fi, and the user agent string may change when their browser automatically updates. Adjust the data checked according to the tradeoffs your site is willing to deal with.
like image 182
0b10011 Avatar answered Sep 23 '22 01:09

0b10011


No, a session is stored on the server and cannot be accessed by the user. It is used to store information across the site such as login sessions.

Here is an example of the usage:

<?php session_start(); if (password_verify($_POST['password'], $hash)) {     $_SESSION['auth'] = true; } ?> 

The session can then be accessed across the site to check to see if the user has been authenticated.

<?php session_start(); if ($_SESSION['auth']) {     echo "You are logged in!"; } ?> 

The user cannot edit these values however the session's ID is stored on a computer through a cookie as a long random string. If an unauthorized user gains access to these strings it is possible for them to access the site.

like image 23
Cameron Avatar answered Sep 27 '22 01:09

Cameron