session management- your opinion

[julianmlp]

Let me talk briefly about how I manage user autentication:

1) As usual, I've a form with User & Passwor
2) If the data matches the Database (users table), I create a Sesion ID
(sessions table), and pass back this info to the user on every link of
the page retieved (SessionID parameter). I set up a cookie in the
client's machine as well
3) Every time the user clicks a link, I read the SessionID parameter,
comparing it to the sessions table data, to see whether he is logged or
not. I also read if he has the cookie.

I think through this kind of procedure is hard to hijack an user
session.
What do you think?

regards - jm

[Janwillem Borleffs]

ju*******@gmail.com wrote:

I think through this kind of procedure is hard to hijack an user
session.
What do you think?

You can test this yourself by faking the HTTP request send to the server
from another machine using a valid session ID.

Just use PHP's socket functions or a HTTP client like wget to send something
like:

GET / HTTP/1.0
Host: yourhost
Cookie: SessionId=<sessionid>

When this succeeds, it means that your sessions aren't binded to a specific
host, and you should revise your approach.
JW

[julianmlp]

Janwillem Borleffs wrote:

ju*******@gmail.com wrote:

I think through this kind of procedure is hard to hijack an user
session.
What do you think?

You can test this yourself by faking the HTTP request send to the server
from another machine using a valid session ID.

Well, I already tried it, and it doesn't work at all. I mean, only
pasting the url in the browser's address bar of another computer, the
user can't authenticate, beacause the cookie isn't there, so in some
way I could say that it is working well.

What I was wondering is: Is there any (simple/easy) way to hijack a
cookie remotely? (to be afraid of)

[Janwillem Borleffs]

ju*******@gmail.com wrote:

What I was wondering is: Is there any (simple/easy) way to hijack a
cookie remotely? (to be afraid of)

When you have the session ID, all you need to do is to pass it as a cookie
header (not from a URL) to fake the call.

With wget, I think it's done with something like:

wget --header="Cookie: SessionID=sessionid" URL
JW

[julianmlp]

Janwillem Borleffs wrote:

ju*******@gmail.com wrote:

What I was wondering is: Is there any (simple/easy) way to hijack a
cookie remotely? (to be afraid of)

When you have the session ID, all you need to do is to pass it as a cookie
header (not from a URL) to fake the call.

I forgot to mention that the cookie's value isn't the same as the
session ID value...

It's something like that:
$val = sha1($ID_session + $HiddenStringWhichNeverLeaveTheServer)

[Jerry Stuckle]

ju*******@gmail.com wrote:

Janwillem Borleffs wrote:

ju*******@gmail.com wrote:

I think through this kind of procedure is hard to hijack an user
session.
What do you think?

You can test this yourself by faking the HTTP request send to the server
from another machine using a valid session ID.

Well, I already tried it, and it doesn't work at all. I mean, only
pasting the url in the browser's address bar of another computer, the
user can't authenticate, beacause the cookie isn't there, so in some
way I could say that it is working well.

What I was wondering is: Is there any (simple/easy) way to hijack a
cookie remotely? (to be afraid of)

Not unless you can intercept the packets somewhere between the server and the
client, or have access to the server file system (assuming you are using the
default session handler in PHP).

The session id is a random string of 32 alphanumeric chars - virtually
impossible for anyone to guess.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[julianmlp]

Jerry Stuckle wrote:

ju*******@gmail.com wrote:

What I was wondering is: Is there any (simple/easy) way to hijack a
cookie remotely? (to be afraid of)

Not unless you can intercept the packets somewhere between the server and the
client, or have access to the server file system (assuming you are using the
default session handler in PHP).

I'm not using the default session handler.

I pass the session ID as

url_to_my_file.php?session=VALUE,

where VALUE is created from:

VALUE = md5(uniqid(rand(), true));

CookieValue = sha1(VALUE + HiddenString);
When I receive a client request, I lookup for the session AND the
cookie's value to see whether the client is logged or not.
It seems to me pretty safe, but I'm not an expert at all...

[Jerry Stuckle]

ju*******@gmail.com wrote:

Jerry Stuckle wrote:

ju*******@gmail.com wrote:

What I was wondering is: Is there any (simple/easy) way to hijack a
cookie remotely? (to be afraid of)

Not unless you can intercept the packets somewhere between the server and the
client, or have access to the server file system (assuming you are using the
default session handler in PHP).

I'm not using the default session handler.

I pass the session ID as

url_to_my_file.php?session=VALUE,

where VALUE is created from:

VALUE = md5(uniqid(rand(), true));

CookieValue = sha1(VALUE + HiddenString);
When I receive a client request, I lookup for the session AND the
cookie's value to see whether the client is logged or not.
It seems to me pretty safe, but I'm not an expert at all...

It's not really any safer than just using the default session handler - which,
as I said before, is fairly safe but not foolproof. However, neither is your
method foolproof.

And if you're doing something which requires that much security, you should be
using SSL anyway - in which case the session id is encrypted anyway.
--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================