3

Background

I've been a php developer for several years but mostly using a open source CMS such as wordpress or drupal. Both of these manage sessions in their own way and for the most part I never paid attention to them. Now I am building a custom website without using these cms's which means I need to manage the session myself. As this has lots of security implications I wanted more information about it. I understand security threats affecting form building and url's and general input but very little about session threats.

I noticed in my chrome inspector that my session cookie was named "PHPSESSIONID". This is of course kind of gross. So I found I could change it using either php.ini setting session.name = "mysitename" or change it in the code using some value such as session_name('mysite_' . $some_value);

The question.

What should I be setting this session name too? Is there a web standard for this? I did search for one and found nothing maybe I have the wrong key-words.

What are the security implications of setting this name? Should I include some specific variable in the name or not include a variable due to some possible conflicts. I'm really starting from scratch on the security side here so any info helps.

Community
  • 1
  • 1
danielson317
  • 3,121
  • 3
  • 28
  • 43
  • 5
    session names are irrelevant. they can be "this_is_the_session_cookie", "RDASDF@3234erasdfWe4r2343", or just "php_sessid". any string that's valid as a cookie name is a valid session name. pick one and move on to more important things. – Marc B Jun 27 '16 at 14:17
  • 1
    https://www.owasp.org/index.php/Session_Management_Cheat_Sheet – Jay Blanchard Jun 27 '16 at 14:18
  • As I understand, you're afraid that someone will know your session name. Are you trying to hide something? You can remove just the php-part. I mean, if you have just one cookie, it'd be obvious that it's the session. – Al.G. Jun 27 '16 at 14:21
  • @Al.G. I don't know what s.o. is. I'm not trying to hide anything per se. I'm just trying to make sure my site is secure. It does have some sensitive information (HIPAA mostly). I know session high-jacking, and man-in-the-middle attacks target session cookies somehow. I just want to make sure I follow best practices for secure systems. – danielson317 Jun 27 '16 at 14:24
  • "This is of course kind of gross." Of course? Leave it alone. No reason to complicate stuff for no good reason. The session cookie's name has no security relevance. Its HttpOnly status may, though. – ceejayoz Jun 27 '16 at 14:55
  • @MarcB If the session id is different based on some variable such as a url argument will it allow the user to have multiple sessions? For example I access the site from `example.com/first` and `example.com/second` and the session name is set to 'example_first' and 'example_second' respectively can the user now switch between two sessions? (assume I cleaned the url parameter before appending). – danielson317 Jun 27 '16 at 15:13
  • in ugly terms, a php session is basically `setcookie(session_name(), session_id())`. if you want to maintain per-directory sessions, then you'll have to pick out appropriate names for each session. but what those names are is pretty much irrelevant. it's just a cookie name, and its name doesn't need to have ANY meaning to anyone except you. – Marc B Jun 27 '16 at 15:14

1 Answers1

4

Changing this name will not have a great impact is as far as I know you do not need to care about this too much. The PHPSESSIONID is the inofficial name for it and therefor does not give so much information about it.

A more important part to prevent abuse of sessions is the use of tokens in any forms. If you need more information about this just tell me.

Another very important aspect is a possible SQL Injection attack which could have an critical impact since you handle sensitive information. To prevent this I recommend the use of prepared statements, more about this here

But back to your sessions, it is very important that you call session_sart at every start of any script and do some testing, I will give you my way of handling sessions below (any critics are highly welcome). This session should have some flags set, like the secure flag and http only, more about php session flags here

Further Sessions should have a limited time and be automatic discarded after this has expired. Another minor point is to regenerate the session id (the value, not the name ;) ) everytime a new session starts, this function does exactly this. Just call it when a user logs in.

I hope this helps, if you have any more questions feel free to ask.

And here is my function which is called at the beginning of every file, except the login page of course:

function auth()
{   
    $curFile = basename($_SERVER["PHP_SELF"]);
    if($curFile == "login.php")
    {
        return;
    }

    $domain = $_SERVER["HTTP_HOST"];

    if(session_status() != PHP_SESSION_ACTIVE)
    {   
        session_set_cookie_params(0, "/", $domain, true, true);
        session_start();
    }

    $now = time();
    if (isset($_SESSION["discard_after"]) && $now > $_SESSION["discard_after"])
    {
        session_unset();
        session_destroy();
        session_set_cookie_params(0, "/", $domain, true, true);
        session_start();
    }

    session_regenerate_id(true);

    $_SESSION["discard_after"] = $now + 120;

    if ((!isset($_SESSION["angemeldet"]) || !$_SESSION["angemeldet"]) && basename($_SERVER["PHP_SELF"]) != "login.php")
    {
        header("Location: https://".$domain."/login.php");
        die();
    }
}

In my login file I set the session as follows:

session_set_cookie_params(1800, "/", $domain, true, true);
session_start();
session_regenerate_id(true);
//Do whatever you want to do to your $_SESSION
$_SESSION["angemeldet"] = true;
$_SESSION["name"] = "Fany name";
//...
Community
  • 1
  • 1
JRsz
  • 2,891
  • 4
  • 28
  • 44
  • 2
    Well, from the comments and this answer it sounds like the actual name of the cookie is irrelevant. Good to know. I can focus on just creating a secure session instead. I am aware of sql injection and how to protect against that. The regenerate session_id thing looks useful so I'll look more into that. Thanks. – danielson317 Jun 27 '16 at 15:08