1

When I read about something "PHP Session vers Cookie" often I found cookies are not mentioned to be save because they are stored at the client side in the browser. And of course a hacker can get access to the PHPSESSID cookie and get the session_id.

So meanwhile I am a little bit confused about the recommondation to run PHP always with the php.ini statements "session.use_cookies = 1" and "session.use_only_cookies = 1".

What could a hacker do if he get this cookie PHPSESSID whigh includes automatically the session_id?

Would it help to make a statement "session_regenerate_id();" after "session_start()"?

Even then the session cookie will be written to the client side and could be read by a hacker.

Am I right to say this makes the idea of a session cookie - which will identify the user even if the browser will be closed - useless?

This is really confusing.

I am a beginner with the security questions of PHP and Sessions. May be I could find some help here to understand this concept. I read already many post but I did not yet found the answer to my specific question.

Arthur Meier
  • 159
  • 1
  • 5
  • 14

1 Answers1

2

The short answer is $_SESSION variables cannot be accessed client side e.g. $_SESSION['variable'] -> NOT stored on client. The $_SESSION id which is used to associate those variables to a client can be accessed as it's stored as a cookie which can be easily manipulated. So for example, if I created a login system which validated a user's credentials, it's common practise to then use this $_SESSION id or a session variable ($_SESSION['loginSuccess']) as the identifier that this login was a success so it can be allowed to access "Locked" pages. A client $_SESSION cookie is only active when the browser is open, if you close the browser down, your $_SESSION cookie will be forced to expire.

The huge security risk is if someone was able to gain access to your session variable using techniques like 'Man in the Middle' attacks (MitM for short). All they would need to do is manipulate there own session id cookie by replacing it with the authenticated cookie and then refresh the page. To get around this, just make your website has an SSL certificate installed from trusted CA (certificate authority e.g. GoDaddy) and enforce your web server to only allow HTTPS connections. This means that all your data transferred from server to client and vice versa is 1-to-1 encrypted.

Even after you have enforced HTTPS, it's worth noting that it's still possible for a MitM attack to be successful and access your encrypted data. This is usually done by the MitM software initiating the SSL acknowledgement on the clients behalf, after that, MitM presents a different SSL certificate (usually self-signed) to the client. By doing this, MitM software can see all encrypted traffic from client and server using 2x SSL certificates. Users would get an error in browser stating the certificate does not match the domain used or is not trusted (because of being self-signed), but as we know, some end users will no doubt accept this. To overcome this issue, most banks check the validity of the client-side certificate using JS and then confirm server-side if it's valid. I've personally not had to go this length for the security of my sites but I'm sure it wont be long before this becomes best practise.

For MitM Info: https://security.stackexchange.com/questions/65794/it-is-possible-to-decrypt-https-traffic-when-a-man-in-the-middle-proxy-is-alread

For SSL JS: Within a web browser, is it possible for JavaScript to obtain information about the HTTPS Certificate being used for the current page?

For Session Hacking: Can session value be hacked?

Community
  • 1
  • 1
Kitson88
  • 2,889
  • 5
  • 22
  • 37
  • Wow-many txs for this complete answer. I'll have a look to all this addresses.Still I'm concerned using the session cookie. What I read is it is a risk - may be is a small one. Now I ask myself if it would be better to setup the session without setting session cookie but verify the session with a value saved stored in a database.What do you think? I know that today there will be no 100% security and I believe this will become more worse over the years. It's a pitty - the interent could be such a nice place without these evil users. But that's a dream. I'm looking for the max. security to get. – Arthur Meier Jan 09 '17 at 06:59