Sessions - Words of Wisdom???

sherry

Hello.

Scenario#1:

I'd like to add sessions to an existing application that doesn't use a login, but I'd like to use it to capture navigation paths so I can see what works and what doesn't, etc. and revise my website accordingly.

I'd like to be able to change the expiration as the data comes in. I'd like it not to be tampered with by '3rd party' as I've read could happen depending on how it is set up. I want to confirm the session's validity either from a flat file or a database and if the session does not exist or has expired, automatically create another (unless say, their IP Address is on the banned list). Would cookies need to be involved in this scenario also?

Any 'words of wisdom' I should know?

Thanks.

sneakyimp

There's lots of wisdom here:
http://php.net/session

sherry

Thanks sneakyimp.

I had looked at that 'wisdom' which is why I created this thread. That reference is good to have in this thread, though.

benracer

http://www.google.co.uk/search?hl=en&sa=X&oi=spell&resnum=0&ct=result&cd=1&q=session+security+php

sherry

Thanks benracer.

There's some interesting and eye-opening info. Wow...much more to security than what I had previously read e.g. when and when not to use cookies with sessions and other ways sessions could be hijacked.

Now on to finding resources for various configurations that work better for certain situations than for others and which parameters to use to make the configuration more sound.

References provides a lot of parameters, but examples don't seem to use many of them and then only others seems to be discussed when folks are troubleshooting their particular situation. Having all of those options is fine as sessions code needs more bells and whistles, but I'm trying to put the time upfront to reduce all of the troubleshooting with browser differences, etc. in addition to providing a good secure starting point.

Here's the confusion -- you read when some folks say, "do it this way", then others counter that and say, "you shouldn't do it that way", and another mentioned that sessions carried over tabs in Firefox and Opera, but wasn't preserved in IE if new windows were opened using the start menu or from the file menu - then with that said, doesn't say under what condition that should be a concern; etc.

I want to configure sessions to work securely in all of the major browsers for the situation I've described in my initial post, so finding resources on those browser's idiosyncrasies, etc. is what I'm looking for then, if need be, I could create 'if' conditions. But then getting around what I've read that there's no sound way to determine if the browser type, etc. provided by environment params is accurate/reliable or even available...and on and on...

I'll begin putting together code for this and revising it as I continue to gather more info. Any suggestions that would assist in this endeavor is welcomed.

...and the beat goes on...

Thanks.

sneakyimp

For sessions to work, a given user's browser needs some way to identify itself to the server. This is usually accomplished by the server generating a SESSION_ID and handing it to the user's browser either by cookie or by adding the SESSION_ID to the end of every URL in a given page.

Cookies are a lot easier.

Session IDs can be stolen more easily IMHO when they are displayed in a URL. Like when Joey logs in and copies a link that he sees and emails it to Jane -- it has the session id at the end! It's a lot harder to steal someone's cookie. I'm not certain, but I think the browser segregates cookies so that they are not visible to a server at another domain.

Cookies are generally easier to work with. You just have to be careful about expiring them, etc.

sherry

Good info, sneakyimp.

Thanks!