Proper session hijacking prevention in PHP

by

Your configuration is awesome. You definitely read up on how to lock down php sessions. However this line of code negates a lot of the protection provided by your php configuration:
session_id(sha1(uniqid(microtime()));

This is a particularly awful method of generating a session id. Based on your configurations you are generating the session id from /dev/urandom which is a awesome entropy pool. This is going to be a lot more random than uniqid() which is already mostly a timestamp, adding another timestamp to this mix doesn’t help at all. Remove this line of code, asap.

Checking the IP address is problematic, ip addresses change for legitimate reasons, such as if the user is behind a load balancer or TOR. The user agent check is pointless, it is like having a GET variable like ?is_hacker=False, if the attacker has the session id they probably have the user agent, and if they don’t this value is really easy to brute force.

More Related Contents:

  1. Session hijacking and PHP
  2. PHP Session Fixation / Hijacking
  3. “Keep Me Logged In” – the best approach
  4. How to properly add cross-site request forgery (CSRF) token using PHP
  5. Preventing session hijacking
  6. What do I need to store in the php session when user logged in?
  7. Is it secure to store a password in a session? [duplicate]
  8. Secure and Flexible Cross-Domain Sessions
  9. how can I print multiple services in this way
  10. Undefined index $_POST
  11. Are PDO prepared statements sufficient to prevent SQL injection?
  12. PHP Pass variable to next page
  13. Why would one omit the close tag?
  14. Reference: What is a perfect code sample using the MySQL extension? [closed]
  15. The ultimate clean/secure function
  16. Preventing Directory Traversal in PHP but allowing paths
  17. Using sessions & session variables in a PHP Login Script
  18. Which $_SERVER variables are safe?
  19. PHP setcookie “SameSite=Strict”?
  20. PHP session side-effect warning with global variables as a source of data
  21. What is the difference between Sessions and Cookies in PHP?
  22. Storing objects in PHP session
  23. Codeigniter Sessions not working after migration
  24. Fastest hash for non-cryptographic uses?
  25. PHP sessions in a load balancing cluster – how?
  26. Best way to avoid code injection in PHP
  27. How to access Magento user’s session from outside Magento?
  28. Destroy or unset session when user close the browser without clicking on logout [duplicate]
  29. Undefined variable: $_SESSION
  30. PHP How can I create multiple sessions?

Leave a Comment