PHP secure Session Check ?

Question

Example,

i have a session that i gave to users that have maching password = stored password, like all simple login system :

if ($pSys->checkPassword($AccountData['password'], $StoredData['password'])) {  // Checks Password and Username
    $_SESSION['login'] = true;
}

so the question is, is this secure enough?

    function loginCheck() // put this on every header page that needs to be loggedin.
    {
        if ( empty( $_SESSION['login'] ))
        {
            header( 'location:index.php' );
            die();
        }
}

is there a diffrence between die() exit() ? second, some say that i should add session_regenerate_id(); ? ( is that an overkill ? ) anyway the real question is said above.

addon*

i have read http://stackoverflow.com/questions/328/php-session-security, but it seems it doesn't match my problem here ( that link is just to general ).

Thanks.

heres the checkPassword()

function checkPassword($password, $storedpassword)
{
    if($password == $storedpassword){
        return true;            
    }
}

Adam Ramadhan

Answer 1

Answering the first part: empty and die are not comparable:

• empty is to check if a variable does not exists or has a value equal to false (see also this type comparison table).
• die is an alias of exit and is used to immediately abort the execution of the current script with an optional message.

Now to your authentication example: Yes, you should use session_regenerate_id to generate a new session ID and revoke the old session ID by setting the optional parameter for session_regenerate_id to true:

if (!sizeof($ErrorAccount)) { // Checks Password and Username
    session_regenerate_id(true);
    $_SESSION['login'] = true;
}

The purpose of session_regenerate_id is to avoid session fixation attacks. This will not be necessary if the server only allows session ids to be sent via cookies, but since PHP by default allows them in URL, you're strongly recommended to regenerate the id.

Answer 2

Since you are looking for answers about security, also don't keep the stored password in plain text. At the very least, salt and hash your passwords, then store the hash. Rehash and compare hashes, not plain text.

Answer 3

You could added a token (hash) to the form and then validate the token to make sure that the token which was submitted via the form is still valid. This helps to prevent CSRF attacks.

You could also store the IP address and browser together with the token in a database for additional validation, however you need to be aware that some ISP's change the clients IP address fairly often and could cause the validation to fail incorrectly.

More Info