1

I have code which changes the current user session, its thought for an admin - to login as a existing user, and back again.

For that I store information in the session and in the DB. So Later I can check that the user trying to become admin, has the session variable - and in DB is the corresponding entry. So an attacker would have to set a session variable, and then also create a DB entry - from that point of view it seems safe to me.

User flow is: The admin clicks a button, and that redirects him to a user frontend. Then in frontend is a button to get back to being admin.

Problem is I feel completely unsure about the following code, I am afraid having opened a security hole, or otherwise made a misstake. Overall this code is strange to me, working with PHP for years, but I never touched sessions.

Does this really properly create a new session?

//clear data in current session
foreach (array_keys($_SESSION) as $key) {
    unset($_SESSION[ $key ]);
}
//create new session id while old is active (takes care of collision)
$new_session_id = session_create_id();
//finish session
session_write_close();
//set new id
session_id($new_session_id);
//start with new id
session_start();

When switching to User following code gets executed after changing session:

 $_SESSION['mysessionkey'] = $admin_id;
//and more code making corresponding entry in db.

similar Question (but old answers and it does not help me - confuses me just more): Can You Switch PHP Sessions In a Session?

2
  • 2
    Facebook has just gotten hacked by doing basically what you described. Also, not sure it's a good idea for admins to login as other users, seems like a large point of failure.
    – Sam
    Oct 23, 2018 at 14:46
  • 1
    Facebook has been hacked through a different security issue, yes "View as user", but ultimately something else, see newsroom.fb.com/news/2018/09/security-update Oct 24, 2018 at 7:19

1 Answer 1

2

I would not do that if i were you. This is to risky.

If you want to make a user switch use a laravel plugin(if you are using laravel).

if you are not using Laravel then you can make an api call for your users and with the api generator you can make a switch system to log you in as the user you want to login as with a new token.

JWT is a api i use to do that and my userswitch works fine.

GoodLuck

4
  • 1
    You mean I should not write my own Login mechanism, but instead use what is provided by the framework I use? JWT is very interesting jwt.io/introduction thx for hint. Oct 24, 2018 at 7:26
  • 3
    Yes that's what I mean it would save you much time and you will be working with API's not sessions's Oct 24, 2018 at 7:41
  • 1
    Well so far the code seems fine, I will soon write an answer myself to this. Yes this is problematic and impersonating a user comes with many caveats. But its a requirement, and I do not use Laravel, nor does the framework I use have such an API. JWT seems pretty amazing, something like that should be used instead of "traditional" php sessions in my opinion; but thats another topic for itself. Nov 1, 2018 at 16:07
  • 2
    Yes Idd it is an another topic (a big one :P ). if you have built in your php api login system then you can add the user switch to it based on the pai key and not the session. Nov 5, 2018 at 9:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.