Menu
How should I host the id of the user on the session? just to insert the id? I mean (for example):
$_SESSION['id'] = 1;
There isn't a way to change it by the user himself (as cookie..)? Because if so, he can change to any id.
One more question about it - how can I check if user is logged in (with sessions)? I created a session:
$_SESSION['is_logged_in'] = true;
Again, can't the user just create a session which his name is 'is_logged_in' and his value is true? or just the server has a control about the value of the server?
681
The most common method of session hijacking is called IP spoofing, when an attacker uses source-routed IP packets to insert commands into an active communication between two nodes on a network and disguise itself as one of the authenticated users.
Session hijacking is a technique used by hackers to gain access to a target's computer or online accounts. In a session hijacking attack, a hacker takes control of a user's browsing session to gain access to their personal information and passwords.
Session Fixation is an attack that permits an attacker to hijack a valid user session. The attack explores a limitation in the way the web application manages the session ID, more specifically the vulnerable web application.
There are three primary techniques for hijacking sessions: Brute Force – the attacker tries multiple IDs until successful. Calculate – in many cases, IDs are generated in a non-random manner and can be calculated. Steal – using different types of techniques, the attacker can acquire the Session ID.
All session variables in PHP are stored server side. The client stores a cookie that references which session should be used, and then the server looks up the values for the session. It is safe to store is_logged_in in your session as well as the user id.
What you should be aware of is if another user gets a hold of another user's session cookie, they will be able to imitate that user until the session times out. One simple solution is to link sessions to IPs.
165
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
