Sessions and security/maintenance

delayedinsanity · 05-06-2008, 05:45 PM

So I'm in the middle of cleaning up my session class and trying to optimize it, and as such I decided to go through the manual some more this morning, focusing on sessions and all related methods. I came across session_regenerate_id(), and now I'm curious.

Does it make sense to make use of this, and how costly is it? The first thought that ran through my head was security. If somebody is trying to hijack a session, via whatever method, if I'm regenerating the ID constantly, this should make it a lot harder, no? I added it to my __construct and so far no buggy behavior with my sessions, and no appreciable increase in execution time.

Also, if anybody has any experience with this method, how comes 'delete_old_session' doesn't work? I would assume this should default to true, as it makes it sound like a mess of old session id's are left around if you don't set it, however it defaults to false according to the manual. So, running PHP 5.2.5, I tried using it, and PHP produces a notice, Use of undefined constant DELETE_OLD_SESSION - assumed 'DELETE_OLD_SESSION' in.... I tried it all in lower and uppercase, both produce a notice.
-m

Highway of Life · 05-07-2008, 05:50 AM

You should be using

PHP Code:


			
session_regenerate_id(true);

That will destroy your old sessions.

And yes, session_regenerate_id() is a good method to use, you shouldn’t notice any decrease in execution or memory consumption when using the function.
Never trust a session id. You should use multiple methods of session authentication to prevent session hijacking.

delayedinsanity · 05-07-2008, 05:59 AM

Thank you.

I do use a few methods, there's an alternate session ID stored in the users table which it authenticates against, and I also attach a hash of the members user agent so if for some reason the user agent string changes halfway through the session it logs them out to help prevent against hijacking. Any suggestions for a fourth line of defense?

Highway of Life · 05-07-2008, 06:09 AM

Ah, excellent.
User IP. :) -- you can validate on the xx.xx.xx only match if you wish, for example some users might have a dynamic IP.
or xx.xx if your security does not have to be that tight, but some IP validation should be used.