Making $_SESSION secure

Created
Active
Viewed 168 times
10 replies

You must be a Member of the collective to start a discussion.

2

Premise

So I heard that session and cookies in PHP can be vulnerable (not sure if it's true). So I had this Idea if I should encrypt those in my projects (mainly the framework I am working on).

Idea

So the basic idea is to have a class of session manager. An unique APP_KEY for the project which is automatically generated during creating the project. Now the session variables can be managed (set/get) via the class.

setting value

  1. Take the value and name for the session
  2. SHA-256 hash the name after salting it with APP_KEY so it is unique for each project.
  3. Encrypt the value via a cipher where the private key is that APP_KEY
  4. Then put it as $_SESSION[$hashed_key] = $encrypted_value

Getting the value

Reverse the setting process

So what'll happen is we can successfully retrieve the data only via the class else if directly retieved, it'd be just some ramndom encrypted key-value pairs.

Code

You'll find the code here

Discussion

So what what I wanna discuss are 4 points

  1. Is this useless?
  2. Is this overkill?
  3. Are there any place for improvement?
  4. Are there any concerning points?

10 replies

Sorted by:
77475157
2

Cookies potentially are a lot less secure than Sessions. So you need to treat the two differently. Your example seems to be entirely about the server-side Session. There's such a thing as session hijacking but on the whole it's a reasonably safe place to put data, since it stays on the server. So unless you have super-sensitive data I'd say it's probably overkill

77475670
0

It's just a class which my framework has which can be used if the user (dev using the framework) wants else he can use normal $_SESSION

77475693
1

I don't disagree with that. You asked if it was overkill to have that class. My response would be Yes. That's all

77475669
1

Seems it won't really help against most common attacks. Stealing cookies by use of XSS or cross origin attacks is very common but this won't protect against it. It doesn't protect the data on the server either since at the server side you'd always have access to the decryption keys.

It doesn't really make much sense to secure things without considering concrete attack vectors. You say "So I heard that session and cookies in PHP can be vulnerable (not sure if it's true)". You need to be aware of concrete weaknesses before you can attempt to mitigate them.

At least I don't see your approach doing any harm. At best it may provide some security-by-obscurity against generic malware.

77475677
0

So, what do you think can be done to improve it? Like any suggestion?

77475727
0

There are mitigations like CSRF tokens or content security policy (CSP). They only work if you use them consistently.

Or you can replace sessions with an entirely different authentication mechanism like JWT that does not rely on cookies that can be stolen

77476085
0

Hmm, I have implemented CSRF already. I;ll try out JWT and CSP

77475864
1

Something to consider is what you use as a session store. If your session store is the local filesystem (which is what PHP does by the default) then your session data will be on the same file system as your webserver. If the session data gets comprimised, yes the data itself will not be readable, but the comprimise means the filesystem that potentially has your application key is also comprimised.

Instead of your Session class, this is typically best handled as described here which will allow you to also save your session data somewhere other than your webserver.

This is not a useless excersise. Sympfony already provides this functionality so it is likely something that is considered useful.

77476101
0

I see. So one thing is I am reluctant of using symphony (not because I hate it or something like that, but like a challenge to me how far I can develop without relying third party)

So, now, instead of transferring the session, what if I try to transfer the key? would that be a valid way? (I just wanna try different things)

77484426
3

"Is this useless?"

Probably.

"Is this overkill?"

Certainly.

"Are there any place for improvement?"

Sure, there is always place for improvement.

"Are there any concerning points?"

Are you aware of the manual page that discusses session settings?