Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #15063

Re: session management

Show all headers | View raw

Erwin Moller wrote:

> As an aside: You don't HAVE TO use a cookie, you can also pass the
> sessionid in the URL, or in a POST, depending on your configuration.

But (to summarize and add to your only partially quoted recommendations 
further below) if you do that you make your application susceptible to 
attacks.  Using a session cookie is the safest approach.  Let the session 
expire after a time of inactivity automagically (you can accomplish that by 
making requests in the background as long there is activity), and make sure 
that the session cookie is HTTP-only to prevent attacks that use client-side 
scripting.  See also Cookie laws (e.g., EU regulations regarding storing 
sensitive information).

> […]
> Now, securitywise:
> 1) Stealing the sessionid
> It is a good habbit to change the sessionid each invocation.

(Is it a habbit or a hare? ;-))

Correct.  And the session should have a unique name:

<http://php.net/session_name>

> (Look up "session fixation")

<http://php.net/session_regenerate_id>

> 2) Protect the serverside storage:
> Serverside: If somebody has access to the directory where the session
> are stored, that person can look into the session.
> I once was in a shared hosting environment where I could see, AND read
> all sessions of PHP, even the once belonging to other people's website.
> (But this was long ago.)

The recommendation (and most common implementation, which *differs* from the 
PHP defaults) is to have a subdirectory or database for storing session 
information, per application, where only the system user running the Web 
server (and maybe the system user of the admin of the application) has 
access.  (It appears to be a little known fact that PHP can transparently 
use a database to store session information instead of in separate files in 
the file system.)
 
-- 
PointedEars
Zend Certified PHP Engineer
Twitter: @PointedEars2
Please do not cc me. / Bitte keine Kopien per E-Mail.

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

session management mrr <mireero@free.fr> - 2015-03-05 08:51 +0100
  Re: session management Erwin Moller <erwinmollerusenet@xs4all.nl> - 2015-03-05 11:54 +0100
    Re: session management mrr <mireero@free.fr> - 2015-03-05 13:59 +0100
      Re: session management Erwin Moller <erwinmollerusenet@xs4all.nl> - 2015-03-05 14:18 +0100
        Thank all! Re: session management mrr <mireero@free.fr> - 2015-03-06 13:47 +0100
          Re: Thank all! Re: session management "J.O. Aho" <user@example.net> - 2015-03-07 08:53 +0100
        Re: session management Jørn Andersen <jorn@jorna.dk> - 2015-03-07 11:59 +0100
          Re: session management "J.O. Aho" <user@example.net> - 2015-03-07 14:21 +0100
            Re: session management mrr <mireero@free.fr> - 2015-03-11 22:23 +0100
              Re: session management Jerry Stuckle <jstucklex@attglobal.net> - 2015-03-11 16:40 -0400
              Re: session management "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-03-11 21:59 +0100
                Re: session management mrr <mireero@free.fr> - 2015-03-13 01:05 +0100
            Re: session management Jørn Andersen <jorn@jorna.dk> - 2015-03-13 02:37 +0100
              Re: session management "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-03-13 02:54 +0100
          Re: session management Richard Damon <Richard@Damon-Family.org> - 2015-03-07 11:29 -0500
          Re: session management Erwin Moller <erwinmollerusenet@xs4all.nl> - 2015-03-09 11:29 +0100
      Re: session management "J.O. Aho" <user@example.net> - 2015-03-05 18:22 +0100
    Re: session management Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-03-06 11:33 +0100
  Re: session management Ben Bacarisse <ben.usenet@bsb.me.uk> - 2015-03-05 11:55 +0000

csiph-web