Is it secure to store a password in a session?

Question

I need to use the password often in a session. I'm crypting my userdata with a key that is crypted by the password. So there is my question. Is it secure to store plaintext passwords in a php session (not a cookie, so non clientside)? Is there a better way? Or should i just ask my user every time for the password?

I encrypt the privatekey of rsa with the userpassword using phpseclib. Everytime I want access to the key I need the password. I have two options: Either I store the password or the key which is I think both not really good. I can't use the passwordhash for the encryption, cause the hash is stored in "plaintext" in the database...

Sessions are stored on the server, you just get a cookie in the browser for the session id — Sam, Oct 25 '13 at 15:45
Personally, I wouldn't consider plaintext passwords stored anywhere to be secure. — Jonathan Lonowski, Oct 25 '13 at 15:46
You can store password this way . The session isn't accessible by the browser! — JoDev, Oct 25 '13 at 15:46
The only thing stored on the client is the session key which is either propagated via cookie or GET parameter. — Praveen Kumar Purushothaman, Oct 25 '13 at 15:46
I stored the hash in a database but I need the plaintext. So is it secure? — Lithilion, Oct 25 '13 at 15:47
Kinda depends on how secure your session is... can it be hijacked? As a rule of thumb, never store passwords... full stop. Not even in the database, you should never need more than a "fingerprint" of the password, a salted hash. You should never be able to retrieve the password. — CD001, Oct 25 '13 at 16:07
If there's a user input field on the site which isn't properly protected, then someone can insert javascript in the input to send the session data to a link somwhere else. — dlofrodloh, Jul 03 '16 at 17:14

score 37 · Accepted Answer · answered Oct 25 '13 at 15:52

Keeping plaintext passwords anywhere in any capacity is usually a bad idea. Sessions are safe as such, but only as safe as the rest of your server environment. Administrators or other users both legitimate and nefarious may have access to data stored on it. You never want to handle the secrets of your customers if you can avoid it; that also means you want to avoid seeing the user's password under any circumstances and you should build your code in a way that the plaintext password is as short lived as technically possible.

If you need to use the password for something during a session, you should architect your app so it never uses the plaintext password, but use a key derivation function to derive a key from the password which you then use for your sensitive tasks. This way there's a lot less chance to expose the user's password. Remember, the only security the user has is the secrecy of his password that only he is supposed to know.

Yes. You can choose to store your derived key in the session knowing it might be compromised if the server is compromised, but at least the users's password is still safe. That way your security failure doesn't become a much bigger problem for users who use the same password elsewhere. — grossvogel, Oct 25 '13 at 15:54

score 12 · Answer 2 · answered Oct 25 '13 at 15:48

12

If doing so and when hackers get access to your server, they will see the passwords in plain text. Never store plain text passwords (wherever)

About the general question. You ask the user once for the password and verify the crypted password against a crypted password stored - let's say in a database. If they are the same then you start a new session. When the user next tries to access your site, you'll check if a session for this user exists. So there is no need to store the password in the session.

answered Oct 25 '13 at 15:48

hek2mgl

152,036
28
249
266

2

When hackers get access to your server, I d'ont thing the PHP session datas is the first he may read... If he is ON the server, he can get an retrieve a lot of things! – JoDev Oct 25 '13 at 15:50
@JoDev A lot of things, yes. But not the plain user passwords – hek2mgl Oct 25 '13 at 15:51
Yes, not directly, but this passwword are probably stored in a SQL database like MySQL... So he can read all password directly from the source! (When we have capacities to hack a server, you can open MySQL...) – JoDev Oct 25 '13 at 15:53
It's more likely you'll have an SQL leak somewhere, which could reveal passwords. It's far more unlikely you'll get root'ed. Hackers very rarely actually get access, reading what you're not supposed to is usally much more common. – Halcyon Oct 25 '13 at 15:53
3

@JoDev Hoping that hacker will not look for session data is a bit naive:) – Oct 25 '13 at 15:53
Nono, just FIRST i said. Not never! I think that he would be able to retrieve password in the databases... – JoDev Oct 25 '13 at 15:54
2

@JoDev No, just their hashes are visible ( do you understand? ) – hek2mgl Oct 25 '13 at 15:54
Just hashes are visible in the DB? It's what you are saying? (It's not a joke, I don't understand very well ^^) – JoDev Oct 25 '13 at 15:58

score 9 · Answer 3 · edited Jun 20 '20 at 09:12

Never store any kind of sensitive data anywhere except the database you should generally avoid using MD5 and SHA family directly.

Then Whats the Solution ?

If you are implementing Authentication system then compare then Client information (generally username and password) then create a special token and then save it to session or cookie.

Example

if ($username == 'someuser' AND $password == 'somepassword_hash'){
    $token = md5(uniqid());
    // database query with along with user_id and token
    $_SESSION['_token'] = $token;
}

Comparing token

functon varifyToken($token){
    
    // database query here
    // SELECT user_id FROM sessions WHERE token = 'token_here'
}

score 4 · Answer 4 · edited Oct 25 '13 at 15:56

4

Never store passwords in plaintext. Aside from that: yes, sessions are safe. Sessions are stored on the server. The session data itself is never sent to the browser.

Whether it is wise or even necessary to store a password in a session, probably not. Maybe for caching reasons but even then it's flakey.

edited Oct 25 '13 at 15:56

Praveen Kumar Purushothaman

164,888
24
203
252

answered Oct 25 '13 at 15:46

Halcyon

57,230
10
89
128

+1 to balance.coz there is nothing to down vote – Nabin Kunwar Oct 25 '13 at 15:54
Edited the answer to undownvote. :) – Praveen Kumar Purushothaman Oct 25 '13 at 15:57
Mhm, at first it was not clear that OP meant to store passwords in plaintext - which is so preposterous I missed it. – Halcyon Oct 25 '13 at 15:58
Yes I was trying to say that just before the answer has been frozen ^^ +1 too – JoDev Oct 25 '13 at 15:59

Is it secure to store a password in a session?

4 Answers4

Then Whats the Solution ?

Example

Comparing token

Linked

Related