ansaurus

Question

Answer 1

+7 A:

Read OWASP A3-Broken Authentication and Session Management. Also read about OWASP A5-CSRF, which is sometimes called "session riding".

You should use this code in a php header file:

ini_set('session.cookie_secure',1);
ini_set('session.cookie_httponly',1);
ini_set('session.use_only_cookies',1);
session_start();

This code prevents session fixation. It also helps protect against xss from access document.cookie which is one way that Session Hijacking can occur. Enforcing HTTPS only cookies is a good way of addressing OWASP A9-Insufficient Transport Layer Protection. This way of using HTTPS is sometimes called "secure cookies", which is a terrible name for it. Also STS is a very cool security feature, but not all browsers support it (yet).

Rook 2010-08-18 23:42:54

Answer 2

+1 A:

I would also suggest storing the user agent and ip information in the session, and verifying it on each request. It's not bullet-proof, but it is a fairly significant increase in robustness. While UA forging is really easy, IP forging, while possible, is MUCH harder... But you may have issues with users who are behind a round-robin IP system such as AOL users...

ircmaxell 2010-08-19 00:01:13

"ip forging" or more commonly called ip spoofing, is impossible for a TCP connection over the internet due to the three way handshake. However a legitimate user's ip address can change during a session due to load balancers on a corporate network or changing wifi hot spots.

Rook 2010-08-19 00:40:24

It's quite possible. It just requires a MITM style attack (where the attacker gets access to one of the end point routers, and then can do what they wish)...

ircmaxell 2010-08-19 00:44:09

It's not "forging" if you can access packets routed to that IP.

tc. 2010-08-19 02:16:31

Answer 3

A:

the best practice i have ever found is save the session data to database or a text file. the database will have user agent, and IP record and check it every request for ensure that the session never been hijacked by other.

for example how session saved at database you can see the implementation at codeigntier session library. in my opinion this way fairly save to prevent someone to hijact session.

Swing Magic 2010-08-19 03:09:16

Checking the user agent is meaningless because this is an attacker controlled variable. Storing the session id in the database means that sql injection gives the attacker immediate access to the system, so he won't need to break a password hash to login. Checking the ip address is error prone because this can change on a legitimate system, for instance if he is behind a load balancer on a corporate network.

Rook 2010-08-19 05:17:41

ansaurus

tags:

views:

answers:

Session hijacking and PHP

related questions