Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p><strong>Note:</strong> Taken from <a href="https://stackoverflow.com/questions/1221447/what-do-i-need-to-store-in-the-php-session-when-user-logged-in/1225668#1225668">my previous answer</a>.</p> <h1>Terminology</h1> <ul> <li><strong>User:</strong> A visitor.</li> <li><strong>Client:</strong> A particular web-capable software installed on a particular machine.</li> </ul> <hr> <h1>Understanding Sessions</h1> <p>In order to understand how to make your session secure, you must first understand how sessions work.</p> <p>Let's see this piece of code:</p> <pre><code>session_start(); </code></pre> <p>As soon as you call that, PHP will look for a cookie called <code>PHPSESSID</code> (by default). If it is not found, it will create one:</p> <pre><code>PHPSESSID=h8p6eoh3djplmnum2f696e4vq3 </code></pre> <p>If it is found, it takes the value of <code>PHPSESSID</code> and then loads the corresponding session. That value is called a <code>session_id</code>.</p> <p>That is the only thing the client will know. Whatever you add into the session variable stays on the server, and is never transfered to the client. That variable doesn't change if you change the content of <code>$_SESSION</code>. It always stays the same until you destroy it or it times out. Therefore, it is useless to try to obfuscate the contents of <code>$_SESSION</code> by hashing it or by other means as the client never receives or sends that information.</p> <p>Then, in the case of a new session, you will set the variables:</p> <pre><code>$_SESSION['user'] = 'someuser'; </code></pre> <p>The client will never see that information.</p> <hr> <h1>The Problem</h1> <p>A security issue may arise when a malicious user steals the <code>session_id</code> of an other user. Without some kind of check, he will then be free to impersonate that user. We need to find a way to uniquely identify the client (not the user).</p> <p>One strategy (the most effective) involves checking if the IP of the client who started the session is the same as the IP of the person using the session.</p> <pre><code>if(logging_in()) { $_SESSION['user'] = 'someuser'; $_SESSION['ip'] = $_SERVER['REMOTE_ADDR']; } // The Check on subsequent load if($_SESSION['ip'] != $_SERVER['REMOTE_ADDR']) { die('Session MAY have been hijacked'); } </code></pre> <p>The problem with that strategy is that if a client uses a load-balancer, or (on long duration session) the user has a dynamic IP, it will trigger a false alert.</p> <p>Another strategy involves checking the user-agent of the client:</p> <pre><code>if(logging_in()) { $_SESSION['user'] = 'someuser'; $_SESSION['agent'] = $_SERVER['HTTP_USER_AGENT']; } // The Check on subsequent load if($_SESSION['agent'] != $_SERVER['HTTP_USER_AGENT']) { die('Session MAY have been hijacked'); } </code></pre> <p>The downside of that strategy is that if the client upgrades it's browser or installs an addon (some adds to the user-agent), the user-agent string will change and it will trigger a false alert.</p> <p>Another strategy is to rotate the <code>session_id</code> on each 5 requests. That way, the <code>session_id</code> theoretically doesn't stay long enough to be hijacked.</p> <pre><code>if(logging_in()) { $_SESSION['user'] = 'someuser'; $_SESSION['count'] = 5; } // The Check on subsequent load if(($_SESSION['count'] -= 1) == 0) { session_regenerate_id(); $_SESSION['count'] = 5; } </code></pre> <p>You may combine each of these strategies as you wish, but you will also combine the downsides.</p> <p>Unfortunately, no solution is fool-proof. If your <code>session_id</code> is compromised, you are pretty much done for. The above strategies are just stop-gap measures.</p>
    singulars
    1. This table or related slice is empty.
    1. POwhat is the efficient way to secure a session variable in php?
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USCommunity
    1. USAndrew Moore
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. POwhat is the efficient way to secure a session variable in php?
      singulars
      1. PTQuestion
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload