[RESOLVED] SESSION ID save to submit via URL?

peter_schneider

I draw statistics/graphs with PHPLOT (pretty nice & free code).

The created graph-imagefile is not being saved to a HD but sent directly to the user's browser by a "session external" script that draws the image.
To transfer session data to that (external) drawing script the internal script submits the SESSION ID along with the generated "HTML-image link" and starts a session in the external script. works fine.

my concern is what the SECURITY RISK is to reveal the SESSION ID to the user by putting it in the HTML code???

the image link would look like this:
<img src="external_script.php?PHPSESSID=4ab2af58(...long code...)47a2af58dc29acdc">

Zanus

Unless people are able to actually view your tmp directory (session directory) then I wouldn't worry to much about it. Though it is considered bad practice to put the session id in the url. One way to feel safe would be to encrypt the session id with a custom algorithm of some kind.

You know... take the string length... multiply by some random number off the top of your head (1036).. append it to an md5 of the session id, etc..

Security by obfuscation would be your best option here since there isn't really much of a threat anyway.

peter_schneider

thanks a bunch zanus.
encryption is an interesting attempt as long as it is possible to decrypt the data before the session is started - can there stand anything before a session start at all??

anyways, i found, that its actually not neccessary to transmit the session id. i just start a session in the external script and it somehow makes the connection to the "internal" session automatically so that i can access all session data there too. guess that's the savest way of all 😉
dont know how or why this works though ... :eek:

johanafm

peter schneider;10939429 wrote:
i just start a session in the external script and it somehow makes the connection to the "internal" session automatically so that i can access all session data there too. guess that's the savest way of all 😉
dont know how or why this works though ... :eek:

There is no real meaning to "external" and "internal" here. The browser sends a get request to retrieve your page. This request contains headers, such as cookies. The browsers gets a response. The response contains headers, such as cookies.

The browsers parses this information and finds an image tag. The image tag has a src attribute, so the browser sends a get request to retrieve the image. The get requests is still a get request, even though it has probably specified that it only accepts mime types of image/*. Since it's a request it contains headers, such as cookies.

And the same goes for css files, javascript files etc.