Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!news.albasani.net!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: Thomas 'PointedEars' Lahn <PointedEars@web.de>
Newsgroups: comp.lang.php
Subject: Re: session management
Date: Fri, 06 Mar 2015 11:33:16 +0100
Organization: PointedEars Software (PES)
Lines: 49
Message-ID: <1628154.CcQIINhEY4@PointedEars.de>
References: <54f7fce9$0$2983$426a74cc@news.free.fr> <54f835eb$0$2851$e4fe514c@news2.news.xs4all.nl>
Reply-To: Thomas 'PointedEars' Lahn <php@PointedEars.de>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8Bit
X-Trace: solani.org 1425638079 25759 eJwNysEBwCAIA8CVBEmQcVBg/xHaex82hc+NoGEw5ieXcuAWFfm4Fxt/EUQC6NAqJsRaWXc+BoAQrw== (6 Mar 2015 10:34:39 GMT)
X-Complaints-To: abuse@news.solani.org
NNTP-Posting-Date: Fri, 6 Mar 2015 10:34:39 +0000 (UTC)
User-Agent: KNode/4.14.2
X-User-ID: eJwdy8ERACEIBLCWEHZBywHF/kvw5p55hObDd8Dp4OV1Q4Su45NVsElgbRG2ZFTq1Z8CpsfYhvrOyOp12DqtHySnFM4=
Cancel-Lock: sha1:QCLyIj+efLj4OeJn/zTVWmzQAUU=
X-NNTP-Posting-Host: eJwFwYERACEIA7CVeLHtMw5ydv8RTJD8ONoENwwXqtiDLHFyx/l9LsS1prvDY91ghmQhFQ8TxxCy
Xref: csiph.com comp.lang.php:15063

Erwin Moller wrote:

> As an aside: You don't HAVE TO use a cookie, you can also pass the
> sessionid in the URL, or in a POST, depending on your configuration.

But (to summarize and add to your only partially quoted recommendations 
further below) if you do that you make your application susceptible to 
attacks.  Using a session cookie is the safest approach.  Let the session 
expire after a time of inactivity automagically (you can accomplish that by 
making requests in the background as long there is activity), and make sure 
that the session cookie is HTTP-only to prevent attacks that use client-side 
scripting.  See also Cookie laws (e.g., EU regulations regarding storing 
sensitive information).

> […]
> Now, securitywise:
> 1) Stealing the sessionid
> It is a good habbit to change the sessionid each invocation.

(Is it a habbit or a hare? ;-))

Correct.  And the session should have a unique name:

<http://php.net/session_name>

> (Look up "session fixation")

<http://php.net/session_regenerate_id>

> 2) Protect the serverside storage:
> Serverside: If somebody has access to the directory where the session
> are stored, that person can look into the session.
> I once was in a shared hosting environment where I could see, AND read
> all sessions of PHP, even the once belonging to other people's website.
> (But this was long ago.)

The recommendation (and most common implementation, which *differs* from the 
PHP defaults) is to have a subdirectory or database for storing session 
information, per application, where only the system user running the Web 
server (and maybe the system user of the admin of the application) has 
access.  (It appears to be a little known fact that PHP can transparently 
use a database to store session information instead of in separate files in 
the file system.)
 
-- 
PointedEars
Zend Certified PHP Engineer
Twitter: @PointedEars2
Please do not cc me. / Bitte keine Kopien per E-Mail.