Secure and Flexible Cross-Domain Sessions

by

What you could do is create “cross-over” links between the sites to carry the session over.

The simplest way is to pass the session id via the query string; e.g.

http://whateverblammo.com/?sessid=XXYYZZ

Before you start thinking that anyone can trap that information, think about how your cookies are transferred; assuming you’re not using SSL, there’s not much difference for someone who taps the network.

That doesn’t mean it’s safe; for one, users could accidentally copy/paste the address bar and thus leaking out their session. To limit this exposure, you could immediately redirect to a page without the session id after receiving it.

Note that using mcrypt() on the session id won’t help much, because it’s not the visibility of the value that’s the problem; session hijacking doesn’t care about the underlying value, only its reproducibility of the url.

You have to make sure the id can be used only once; this can be done by creating a session variable that keeps track of the use count:

$_SESSION['extids'] = array();

$ext = md5(uniqid(mt_rand(), true)); // just a semi random diddy
$_SESSION['extids'][$ext] = 1;

$link = 'http://othersite/?' . http_build_query('sessid' => session_id() . '-' . $ext);

When received:

list($sid, $ext) = explode('-', $_GET['sessid']);
session_id($sid);
session_start();
if (isset($_SESSION['extids'][$ext])) {
    // okay, make sure it can't be used again
    unset($_SESSION['extids'][$ext]);
}

You need these links every time a boundary is crossed, because the session may have gotten regenerated since the last time.

More Related Contents:

  1. PHP Sessions across sub domains
  2. PHP Session Fixation / Hijacking
  3. “Keep Me Logged In” – the best approach
  4. How to properly add cross-site request forgery (CSRF) token using PHP
  5. Preventing session hijacking
  6. What do I need to store in the php session when user logged in?
  7. Cross domain PHP Sessions
  8. Session hijacking and PHP
  9. Is it secure to store a password in a session? [duplicate]
  10. Proper session hijacking prevention in PHP
  11. How to change the session timeout in PHP?
  12. Two-way encryption: I need to store passwords that can be retrieved
  13. Secure random number generation in PHP
  14. Where to put password_verify in login script?
  15. PHP session without cookies
  16. PHP Session timeout
  17. SQL injections in ADOdb and general website security
  18. Why is PHP session_destroy() not working?
  19. CORS not working php
  20. How long will my session last?
  21. In a PHP / Apache / Linux context, why exactly is chmod 777 dangerous?
  22. How to sanitze user input in PHP before mailing?
  23. best practice to generate random token for forgot password
  24. How to prevent PHP sessions being shared between different apache vhosts?
  25. How to set lifetime of session
  26. PHP & Sessions: Is there any way to disable PHP session locking?
  27. How to set session timeout in Laravel?
  28. Cookies vs. sessions in PHP
  29. How can I determine a file’s true extension/type programmatically?
  30. PHP How can I create multiple sessions?

Leave a Comment