0

When a user logs in a random session ID is generated and stored in their database table row and also in their session variable. Before any authenticated part of the site is accessed, there is a check to see if the session ID stored in the session variable is the same as that in the user’s table row.
My question is, is that any safer than just setting a boolean flag in the session variable?

Thanks

user1168320
  • 129
  • 3
  • 10
  • The session variables that you store in the session dictionary is a simple in memory dictionary set upon receive of a session id through an HTTP cookie from the client. That session id already randomly generated with a large key space, or users would be able to guess each other's session ids, so that you generate a new session id is completely wasteful and unnecessary. Let PHP and whatever framework you got handle the authentication. Make sure to encrypt the transport with HTTPS and you're safe enough. – Henrik Aug 31 '12 at 14:11

1 Answers1

0

It's slightly safer. Now, the attacker has to be able to read some part of your communications with the client (say, by sitting outside their office with a WiFi sniffer, or at the next table at Mc Donald's, or next to them on a bus).

It's still not a particularly good idea, though. Google “Replay attack,” for starters …

BRPocock
  • 13,638
  • 3
  • 31
  • 50
  • MITM attacks are not specific to the *authentication* protocol, but rather transport security, so your answer doesn't make much sense. – Henrik Aug 31 '12 at 14:08