7

How to prevent PHP sessions from being shared between different Apache vhosts?

I've set up different vhosts on an Apache 2.2 and everything works perfectly, until I realized that the PHP sessions are shared by default.

2
  • 1
    How about creating a token, one for host 1 and another for host 2?
    – Daryl Gill
    Aug 15, 2013 at 22:25
  • @DarylGill That's a good idea, but maybe too much. I wanted to "present" different versions of a script, and changing the code would not really show the real version. And it's a lot of work too ;)
    – Sliq
    Aug 15, 2013 at 22:31

2 Answers 2

13

Edit is also the reason why you ALWAYS should set your session_save_path ( http://php.net/manual/en/function.session-save-path.php ) or use database session handling ( http://php.net/manual/en/class.sessionhandler.php ) if you are on an shared webhosting. Somebody can create an session id on there site and chmod it to 777 and use that session id on your site to bypass logins/or get more privileges. It can also be used for SQL injections.

This works because PHP doesn't enforce what session IDs belongs to what site. I know this because I've analysed the C/C++ source code behind sessions in PHP, and because I wondered how this could be possible. So never put too much trust that the $_SESSION array is safe on shared web hosting and you can't safely use this value in a SQL query.

Some code (file session.c) in PHP from C function php_session_start(); yes, this function is called when you call session_start() from PHP (and the only check I saw was in these lines of code):

/* Check whether the current request was referred to by
 * an external site which invalidates the previously found id. */

if (PS(id) &&
        PS(extern_referer_chk)[0] != '\0' &&
        PG(http_globals)[TRACK_VARS_SERVER] &&
        zend_hash_find(Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_SERVER]), "HTTP_REFERER", sizeof("HTTP_REFERER"), (void **) &data) == SUCCESS &&
        Z_TYPE_PP(data) == IS_STRING &&
        Z_STRLEN_PP(data) != 0 &&
        strstr(Z_STRVAL_PP(data), PS(extern_referer_chk)) == NULL
) {
    efree(PS(id));
    PS(id) = NULL;
    PS(send_cookie) = 1;
    if (PS(use_trans_sid) && !PS(use_only_cookies)) {
        PS(apply_trans_sid) = 1;
    }
}

The only check is the HTTP Header "HTTP_REFERER", but we all know it can be faked, so this is "security through obscurity". The only safe method is to use session_save_path or use a database session handler.

To set session_save_path in the php.ini, you should find more information here http://php.net/manual/en/session.configuration.php.

Or, if PHP is running as an Apache module, you can configure it in the htaccess file of vhost container:

php_value session.save_path "path"

Or even better a PHPINIDir per vhost:

<VirtualHost ip>
[...]
PHPINIDir /var/www/...
[...]
</VirtualHost>

UPDATE [Panique]:

I'm just adding the full solution to this answer, as this might help other people too. A sample full vhost setup:

<VirtualHost *:81>
    DocumentRoot /var/www/xxx1
    <Directory "/var/www/xxx1">
        AllowOverride All
        php_value session.save_path "/var/mysessionforproject_1"
   </Directory>
</VirtualHost>

<VirtualHost *:82>
    DocumentRoot /var/www/xxx2
    <Directory "/var/www/xxx2">
        AllowOverride All
        php_value session.save_path "/var/mysessionforproject_2"
   </Directory>
</VirtualHost>
2
  • but all vhosts share one php.ini... or am i missing something ?
    – Sliq
    Aug 15, 2013 at 22:42
  • updated and you could use PHPINIDir per vhost container to configure a php ini per vhost Aug 15, 2013 at 22:44
0

Something is very wrong with your browser if it's sending cookies across domains.

Certainly both vhosts using the default session handler will write their session files to the same directory - just override it in the Apache vhost config:

<VirtualHost a.example.com>
    ...
    php_value session.save_path "2;/var/www/a.example.com/data"
4
  • It's about sessions, not cookies. And it's not a browser thing. I'm routing different ports to different subfolders. Maybe that's the point.
    – Sliq
    Aug 15, 2013 at 22:54
  • While it is possible to implement HTTP sessions without cookies, it's a very dangerous practice - hence the warnings in the manual, and that URL binding has always been disabled by default. And even if it is enabled the handler won't attach the session id to a non-native domain.
    – symcbean
    Aug 15, 2013 at 23:01
  • Maybe I should add that this is not a real app, it's just a demo of various versions of a script. nothing critical here.
    – Sliq
    Aug 15, 2013 at 23:03
  • If you mean that you're using the same FQDN in both virtualhost configs but different ports, then that's exactly how it's supposed to behave.
    – symcbean
    Aug 15, 2013 at 23:04

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.