1

What is the best way to know if user is the right guy and not a hacker? For example in my project when user is logging in I create some session variable with some number and then on other pages I check this session variable and according to it's value give user some options.

So can hacker change this variable somehow so server side will grant him access to some options ?

If so what is the best way of holding some users rights and passing them to different pages , so server can grant that user with some options ?

3 Answers 3

7

To understand Session Hijacking more clearly, there are several methods by which a hacker hijacks the session let me put some light on different types of session hijacking.

according to Wikipedia

There are four main methods used to perpetrate a session hijack:

  1. Session fixation, where the attacker sets a user's session id to one known to him, for example by sending the user an email with a link that contains a particular session id. The attacker now only has to wait until the user logs in.

  2. Session sidejacking, where the attacker uses packet sniffing to read network traffic between two parties to steal the session cookie. Many web sites use SSL encryption for login pages to prevent attackers from seeing the password, but do not use encryption for the rest of the site once authenticated. This allows attackers that can read the network traffic to intercept all the data that is submitted to the server or web pages viewed by the client. Since this data includes the session cookie, it allows him to impersonate the victim, even if the password itself is not compromised.1 Unsecured Wi-Fi hotspots are particularly vulnerable, as anyone sharing the network will generally be able to read most of the web traffic between other nodes and the access point.

  3. Alternatively, an attacker with physical access can simply attempt to steal the session key by, for example, obtaining the file or memory contents of the appropriate part of either the user's computer or the server.

  4. Cross-site scripting, where the attacker tricks the user's computer into running code which is treated as trustworthy because it appears to belong to the server, allowing the attacker to obtain a copy of the cookie or perform other operations

While there are several solution to stop this kind of hijacking for example for the second one using a SSL or https would be appropriate to avoid it. however if you want to add more security for your session then one solution i came across is by allowing passing of seesionId's via Cookies only, and generate and additional session token that is passed via URL. and only request that contain a valid Session toekn may access the session.

Below is the example demonstrating the example taken by Orielly PHP CookBook.

ini_set('session.use_only_cookies', true); 
session_start();
//Create a random salt value
$salt = 'Hjkhkjh9089&j98098';
$tokenstr = (str) date('W') . $salt; 
//Create a md5 hash to be used for token.
$token = md5($tokenstr);
if (!isset($_REQUEST['token']) || $_REQUEST['token'] != $token) { 
    // prompt for login
    exit; 
}
$_SESSION['token'] = $token; 
output_add_rewrite_var('token', $token); 

Now what output_add_rewrite_var does it it adds another name/value pair to the url rewrite mechanism via Get method. read more about the function here. output_add_rewrite_var

to read more about session security i suggest you read this article http://hungred.com/useful-information/solutions-session-attacks/

hope this helps you in understanding the vulnerabilities of sessions and how to fix it.

1
  • You are checking the Request's token vs the newly generated token, it will fail unless the client makes it request within the same second.
    – Jacco
    Commented Aug 30, 2011 at 14:05
1

create hash from ip ( better not ) , session id and some other unique data in user cookie and check for each request... with this way you can control session hijack

in other hand you must have table to each session for privilege like acl system ... save all setting in database and with session id find all settings

3
  • 2
    IP can change for many valid reasons, think about load balancing proxies or roaming mobile users.
    – Jacco
    Commented Aug 30, 2011 at 14:06
  • in connection its not change ... if its change give another session Commented Aug 31, 2011 at 10:35
  • Try, and your users will hate you.
    – Jacco
    Commented Aug 31, 2011 at 10:41
0

Honestly, if you're not fluent in authentication methods, I'd suggest using an established provider (or similar, such as Google, Facebook, Twitter, etc. using oAuth) who have experts in the subject. Why try and re-invent the wheel when there are large companies with field experts providing this exact service? Using these providers will also give you insight into how to provide secure authentication for your systems.

3
  • 3
    Some of us don't Facebook or Twitter, and it's very frustrating to come across a site and then realize you can't use it. I know this method is all the hype these days, but some people still prefer to a classic login.
    – mfonda
    Commented Aug 29, 2011 at 18:06
  • then as a last option offer openID as well as google, facebook, twitter, ect.. at first I was annoyed at the concept that I had to register for ANOTHER site just to use the one I was after, but that soon faded as I use the same openID for most of my sites (that support it)
    – rlemon
    Commented Aug 29, 2011 at 18:11
  • @mfonda: True (and I'm still an advocate of implementing your own login solution to provide users on top of the other providers), my point was more that if you're not intimately familiar with security details and concerns, it's much better to use the given providers and learn from them and eventually implement your own (if deemed necessary). Why leave your customers vulnerable? Commented Aug 29, 2011 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.