If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session hijacking then what I have already. I would like to keep the security measures to my PHP code and not in any of the web server settings.
Here is what I am doing right now:
- When a user logs in, session_regenerate_id() is called
- A session variable is created which stores the users IP address which is decided from HTTP_X_CLUSTER_CLIENT_IP, HTTP_CLIENT_IP, HTTP_FORWARDED, HTTP_FORWARDED_FOR, or REMOTE_ADDR (whichever is found first)
Anyone have any tips on what else I should be doing? I was also wondering what the best method is to determine the users IP address so it can't be spoofed?