Session ID

MBK

I have a script that uses sessions and it works fine, I want to add more security to it using the Session ID.
When I start a session and I then view the source I get: -

 <input type="hidden" name="PHPSESSID" value="gfg3f4g344g31g43gdf32g" />

I have seen sites where the value is presented in the URL Location, and want to add it to mine as well.
Does this make sense.

Instead of just reading www.bob.com/test.php I want to show
www.bob.com/test.php?s=gfg3f4g344g31g43gdf32g

Please can someone help me?!

MBK

Can anyone help me pls?!

bastien

http://www.php.net/manual/en/function.session-start.php

i found it most helpful

MrAlaska

Putting the session ID in the URL has nothing to do with security, it actually reduces security compared to putting the session ID in a POST or COOKIE. By default, if cookies are disabled all forms will have the code you posted and local links will have the URL appended with the session ID.

pdaoust

hmmmmmmmmmm... I think that both the <input type="hidden"> or the tagging of the session ID onto the URL are fairly low-security ways of passing the session ID around... you'd probably want to use either cookies or POST data.

How on earth do I do this, you ask. It's actually set up through php.ini in the [Session] category. If you want PHP to force cookies, make sure session.use_cookies and session.use_only_cookies are set to 1. If you reeeeally want to stick the session variable in the URL, make sure session.use_only_cookies is 0 and session.use_trans_sid is 1. (BTW, "use_trans_sid" means "use transparent session id", which indicates the trust the authors of PHP put in this style of session management.)

hope this helps!!!
Paul

MrAlaska

Originally posted by pdaoust
hmmmmmmmmmm... I think that both the <input type="hidden"> or the tagging of the session ID onto the URL are fairly low-security ways of passing the session ID around... you'd probably want to use either cookies or POST data.

Using <input type="hidden"> IS availing itself to the POST, unless the form action is set to GET.

My PHP does not have session.use_cookies_only, I do not understand the introduction of that setting. It seems to me setting use_trans_id to 'Off' would accomplish the same purpose, but I do not use native sessions so I might be missing some aspect of their behavior.

The default settings in the PHP.ini usta use cookies by default and only insert the session id in the URL if the client does not accept cookies. I just checked the documentation and it seems to say that is the default behavior $_SESSION uses but it also appears use_trans_id is set to '0' by default. Does turning that off ALWAYS insert into the URL? I am obviously missing something here, or reading something wrong.

Forcing cookies is more secure if $SESSION is the only means you are using to validate, but $SESSION is not a secure form of validation anyway. For securing $_SESSION you should collect client environmental variables to validate the session against, which would signifigantly reduce any breaches via putting the ID in the URL.

Many visitors have cookies disabled so you really should write it into your code to tell those visitors why they are not able to log in if you force cookies. Even cookies can be sniffed though, and no matter what you do the login password is passed in plain text, so SSL is the next level of maintaining security where it is important.

minorgod

Two things,
first, contrary to popular opinion, passing your SID in the URL is not really a security problem if you are doing checks for other variables as well. If a hacker compromises your SID, they still have to know how your security is set up on the server, or if you left a bunch of debug code in your scripts then they might just find a way to force an error that would make your debug code divulge the names of authentication variables. Then, of course, they'd need to find valid values for all those variables to compromise your session. So don't worry about passing your SID. What you SHOULD worrry about is the other stuff that most peole don't worry about, such as making sure your application doesn't reveal the contents of your $_SESSION array when it encounters an error.

I've personally seen several sites that had ASP bugs that did this and I recently came across a PHP site that had a similar problem.

Second, here's a great tutorial on writing your own custom session handlers for PHP so you don't have to rely on anyone else's methods (though you're better off following a tutorial if you're not sure what you're doing). Here's the tutorial link:

http://www.phpbuilder.com/columns/ying20000602.php3