Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When displaying a page with content only logged in users should see, I simply check

if(isset($_SESSION['hasLoggedIn']))
{
  //show content
}
else
{
  echo 'you must log in';
}

In this article it recommends checking the IP address and browser each time.

$_SESSION['login_string'] = hash('sha512', $password.$ip_address.$user_browser);

Is this necessary? I thought since session variables only existed on the server they are not prone to attack? I kind of don't get why $password is there. If the password is being passed to each page, wouldn't it be easier for the database with the userid/password to be queried, or is the idea that this way the database doesn't need to be queried (which is time consuming)?

share|improve this question
    
You should check out this list of secure session practices –  makerofthings7 Mar 22 '13 at 6:12
    
@makerofthings7 must I know about session hijacking to understand what is going on here? –  Celeritas Mar 22 '13 at 7:55
    
Yes, it is enough to check whether the session is set or not. –  user2243593 Apr 6 '13 at 10:08
add comment

1 Answer

up vote 1 down vote accepted

There are other things to consider to get a secure session handling, like using SSL, regeneratig the session id, and more. But to get the login state from the session, it is enough to test if a certain value is set, like you did.

Of course you can store additional information about the user connetion in the session, but password and ip-address are not appropriate. Especially the password should not be stored plaintext on server-side, and that is what you need to check the hash in your example. The ip-address is not a reliable information, it could be dynamic and change during the visit of the user. In this case the user would be denied access, even if he had logged in successfully before.

If you want to store additional information, i would recommend to write this fingerprint into a separate variable like $_SESSION['client_fingerprint']. There is an article from Chris Shiflett (see section: Preventing Impersonation), it shows that there are not many informations appropriate to generate this fingerprint.

share|improve this answer
    
How frequently would the IP address change? If the IP changes every day I think it's still a good idea to check it. –  Frank_Hemsworth Mar 23 '13 at 22:52
1  
I answered my own question. "Most notably, a single user can potentially use a different IP address for each request (as is the case with large ISPs such as AOL)" –  Frank_Hemsworth Mar 23 '13 at 23:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.