Session ID guessing prevention

[MikeM2468]

I've got a PHP login script that uses LDAP for authentication. As it is now, it just sets $_SESSION['user'] based on the result of the LDAP query. Obviously just checking that $_SESSION['user'] is set is not a good way to secure things as it can be easily guessed. What's a good way to make it secure?

 

[jpadie]

how can someone guess whether a session variable is set?

 

[MikeM2468]

If I create a dummy script that only sets $_SESSION['user'] = "test" and then have it open a protected page, the page opens if it is only validating that $_SESSION['user'] is set.

 

[jpadie]

sure. but as you have controls over all the scripts that are run on your server, what's the problem?

if you are worried about multiple applications on the webserver reusing the 'user' session key, set a specific session name on the relevant application

session_name('my_hyper_secret_session');
if(session_id() == '' ): session_start(); else: die(); endif;

i don't see any other method of skinning the cat as the 'value' of the session key is also arbitrarily set by scripts under your control.

you could decrease the chance of spoofing or multi-terminal access by

1. setting a timecode on each access and timing out the login if there is inactivity beyond x minutes
2. recording the IP address of each access and killing the session if the IP address changes.

 

[MikeM2468]

Maybe I'm overthinking it or I don't understand the limits. Can the session only be created on-server?

So this wouldn't work from some outside host:

session_start(); 
$_SESSION['user'] = "test";
header("Location: [URL unfurl="true"]http://www.mydomain.com/secretscript.php");[/URL]

 

[jpadie]

No. you cannot execute php from the client side.
the session data resides only within the session store.
the session store resides (usually) in the file system of the server (you can configure this to store the data in a database instead).
the session is identified by the value of a cookie sent by the browser. no actual session data is stored on the client side.

 

[MikeM2468]

I didn't mean client side. I meant from another server. The other server - out in the world somewhere - has a script that creates the session and tries to open my script remotely.

 

[jpadie]

unless that other server has write access to your server and had the same DNS host name so that the cookie would be in the same domain, I don't see the danger.
and if you have given a remote server write access then you either trust it or have compromised security already. so the point is moot.