session_regenerate_id()

[Marcus]

Hello,

With regards to session_regenerate_id(), as Gordon pointed out on a
previous post, the parameter to delete the old session was not added
until PHP 5.1.0. I am running the 4.3 series, and am trying to manually
delete my old session as I am calling session_regenerate_id() on every
user request.

I do not want PHP's garbage collection script to run every time as that
would obviously be a huge performance hit, and I checked in my session
data folder and noticed that indeed the function does create a new
session file for each request.

However, every time I regenerate the ID, I am storing the session array
in a temp var, then killing the old session and the associated cookie,
and then reassigning the session array to the new session. As a result,
all of the previous session files become empty (0 Kb) and only the
newest session has the data.

My question is even though there are technically many more valid
sessions with this method, does it matter? I know an attacker could
hijack one of these sessions, but as far as I understand it, wouldn't it
be useless since there is no info in there? I have found conflicting
reports online so I am not sure if I am overlooking any vulnerabilities
with this model.

Thanks in advance!

[Gordon Burditt]

>With regards to session_regenerate_id(), as Gordon pointed out on a

previous post, the parameter to delete the old session was not added
until PHP 5.1.0. I am running the 4.3 series, and am trying to manually
delete my old session as I am calling session_regenerate_id() on every
user request.

I do not want PHP's garbage collection script to run every time as that
would obviously be a huge performance hit, and I checked in my session
data folder and noticed that indeed the function does create a new
session file for each request.

However, every time I regenerate the ID, I am storing the session array
in a temp var, then killing the old session and the associated cookie,
and then reassigning the session array to the new session. As a result,
all of the previous session files become empty (0 Kb) and only the
newest session has the data.

My question is even though there are technically many more valid
sessions with this method, does it matter?
It depends on your code.
I know an attacker could
hijack one of these sessions, but as far as I understand it, wouldn't it
be useless since there is no info in there?
If the user comes to your page with an existing but empty session,
do you assume he's logged in? If so, you're in big trouble. What
is that user allowed to do? If every page seeing such a session
redirects the user to the login page, you're probably OK.
I have found conflicting
reports online so I am not sure if I am overlooking any vulnerabilities
with this model.

Gordon L. Burditt

[Nicholas Sherlock]

Marcus wrote:

With regards to session_regenerate_id(), as Gordon pointed out on a
previous post, the parameter to delete the old session was not added
until PHP 5.1.0. I am running the 4.3 series, and am trying to manually
delete my old session as I am calling session_regenerate_id() on every
user request.

Do you realize that this stops users from using multiple tabs/windows to
browse your website?

Cheers,
Nicholas Sherlock

[R. Rajesh Jeba Anbiah]

Nicholas Sherlock wrote:

Marcus wrote:

<snip>

I am running the 4.3 series, and am trying to manually
delete my old session as I am calling session_regenerate_id() on every
user request.

Do you realize that this stops users from using multiple tabs/windows to
browse your website?

That is the *real* use of session_regenerate_id(), especially to
avoid back button.
--
<?php echo 'Just another PHP saint'; ?>
Email: rrjanbiah-at-Y!com Blog: http://rajeshanbiah.blogspot.com/