breaking into SESSION variable

Question

In every PHP file in my project I am using the following code so that nobody can get into the website without logging in:

<?php
    session_start();
    if($_SESSION['userid']!="myuserid"){
        header("Location: Adminlogon.php");
    }
?>

Note that I need only one user id, the user id and password is shared among a group of people.

Is this code safe? Can I do better?

It's not bullet-proof (few things are), but it will do well enough for a simple deterrent. — Blake, Apr 26 '12 at 17:42
If you're looking for security then I'm not sure a shared id/password is a great way to go, unless you're enforcing only one sign-on at a time (i.e. if someone else tries to sign on you deny it as long as there's a session active). If not then what's to stop people for sharing the id/password with other (unauthorized) users? — TheOx, Apr 26 '12 at 17:51

Superbiji · Answer 1 · 2012-04-26T18:14:43.747

0

That will be safe, but cookie and session can be easily "hijacked" in LAN when you are using plain HTTP. So force your application server to use HTTPS

edited Apr 26 '12 at 18:14

answered Apr 26 '12 at 17:46

Superbiji

1,723
2
14
21

How do I force the application server to use HTTPS? – Rahul Desai Apr 26 '12 at 17:53
you can try this: http://stackoverflow.com/questions/85816/how-can-i-force-users-to-access-my-page-over-https-instead-of-http – Superbiji Apr 26 '12 at 18:13

score 0 · Accepted Answer · answered Apr 26 '12 at 18:57

0

Your code is not safe, because actually it does not prevent from each script being executed - which is what you actually want to prevent.

To prevent execution if the session is not set correctly, you need to leave the file, for example with the return statement:

<?php
    session_start();
    if ($_SESSION['userid'] != "myuserid")
    {
        header("Location: Adminlogon.php");
        return; ### leave this script/include
    }
?>

Instead of return you can also use the exit or die statement for rudimentary scripts.

answered Apr 26 '12 at 18:57

hakre

193,403
52
435
836

If your program has any registered shutdown functions or object destructors, they will still run even after the exit statement. – Dmitri Snytkine Apr 26 '12 at 19:03
@DmitriSnytkine: And if you've got a serialized payload inside the session, it will exploit the application as well. – hakre Apr 26 '12 at 20:16

breaking into SESSION variable

2 Answers2