serious security issue with sessions

dipens

My browser:
IE 5.50.4522.1800 Update Version:; SP1;

When running the script below on different instances of my browser I get the SAME session id appear. This does not occur in IE5.0 or Netscape 4.6/4.73 (i.e., I get the expected behaviour of different session ids appearing).

Has anyone else encountered this problem?

Many Thanks
Dipen

<?
//Start the session.
//This must be called before
//sending any content.
session_start();

//Register a couple of variables
session_register("Name");
session_register("Count");

//Set variable based on form input
if($inputName != "")
{
	$Name = $inputName;
}

//Increment counter with each page load
$Count++;

<HEAD>
<TITLE>Listing 7.6</TITLE>
</HEAD>
<BODY>
<?
//print diagnostic info
print("Diagnostic Information \n");
print("Session Name: " . session_name() . " \n");
print("Session ID: " . session_id() . " \n");
print("Session Module Name: " . session_module_name() . " \n");
print("Session Save Path: " . session_save_path() . " \n");
print("Encoded Session:" . session_encode() . " \n");

print("<HR>\n");

if($Name != "")
{
	print("Hello, $Name!<BR>\n");
}

print("You have viewed this page $Count times!<BR>\n");

//show form for getting name
print("<FORM ACTION=\"$SCRIPT_NAME?".SID."\" METHOD=\"POST\">");	
print("<INPUT TYPE=\"text\" NAME=\"inputName\" VALUE=\"$Name\"><BR>\n");
print("<INPUT TYPE=\"submit\" VALUE=\"Change Name\"><BR>\n");	
print("</FORM>");

// added by dk (n.b. $SCRIPT_NAME is apache environment variable)
print("script_name:  " . $SCRIPT_NAME . "<BR>\n");
print("SID:  " . SID . "<BR>\n");
// ----------------------------------------------

//use a link to reload this page
print("<A HREF=\"$SCRIPT_NAME?".SID."\">Reload</A><BR>\n");

?>
</BODY>

Anon

why is this a security issue? say your site opens a new window, you want the session info passed on to the new window - you dont want the user to log back in. session info is shared between multiple instances of the same browser.

-paul
http://xhawk.net

dipens

Hi Paul,

The reason this is a security issue is that the session info is passed to a new instance of the browser (i.e., when you click on start menu->internet explorer). I understand that session data should be passed around new instances of the browser (when the user hits Ctrl-N within IE).

Eg:
1. Open up IE - the php script creates a session.
2. Close this window (so that there are no more IE browser windows on the desktop).
3. Open a new IE window...the php script shows the same session id as it did in step(1) - no matter how many times you repeat the above steps.

Many Thanks
Dipen

paul wrote:

-paul
http://xhawk.net