Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

I have a PHP website and my question is:

If someone manages to steal my users' cookies via an XSS attack,
is it enough for him to be identified as the user?
Or does his IP also have to be the same as the logged in user?

My php.ini has session.use-cookies and session.use-only-cookies set to true

share|improve this question
1  
If your looking to help protect cookie sessions, I'd reccomend looking at HTTPOnly cookies and Session Fixation Protection (for post login). owasp.org/index.php/Session_Fixation_Protection Of course both not full proof, but helps add layers to security. – Alex Key Aug 24 '11 at 16:43
Thanks, this is indeed an important factor. – fiftyeight Aug 24 '11 at 18:37

2 Answers

up vote 8 down vote accepted

Cookies only; of course, there's nothing preventing you from this:

if (empty($_SESSION['ip']) {
  $_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
} else {
  if ($_SESSION['ip'] != $_SERVER['REMOTE_ADDR']) {
    // IP changed
  }
}

Note that identifying a user by IP address is only a stopgap measure, and I wouldn't consider it relevant to security - e.g. large organizations use NAT, so multiple computers will appear as having the same address to the Internet at large. Conversely, e.g. mobile users' IP address can change often, so don't automatically assume "same IP address == same user, different IP address == different user".

Further concerns: IPv4 and IPv6 dual-stack, IPv6 Privacy Extensions, etc.

share|improve this answer
3  
I had this implementation "issue" earlier, and someone pointed out to me a problem they had issues with AOL customers, when they identified the HTTP-session with both cookie and ip. It turned out that every AOL user changed IP for each HTTP request, due to some outgoing transparent proxy. – Dog eat cat world Aug 24 '11 at 18:30
Yep, guess I'll stick with the default configuration, thanks a lot for the explanation though. – fiftyeight Aug 24 '11 at 22:49
up vote 5 down vote

A PHP 'SESSION' cookie does not incorporate IP address information out of the box. It is possible to associate it with that information, as Piskvor showed, but doing so may break the application for some users. See OWASP's discussion of the possible problems that IP address binding can cause.

share|improve this answer
2  
This is a bit of technical detail about PHP session cookie generation. In the generation of the PHPSessionID, it uses the REMOTE_ADDR, if available. This is however only part of the "random" entropy. Fun fact: Given a few factors, you can predict PHP sessionid's :) – Dog eat cat world Aug 24 '11 at 18:34
1  
Just to be clear, it's using REMOTE_ADDR to generate the pseudo-random identifier, it's not incorporating REMOTE_ADDR in any way that allows the PHP programmer to compare current REMOTE_ADDR against the original REMOTE_ADDR used at session creation time, correct? – gowenfawr Aug 24 '11 at 18:42
1  
correct. Have a look here: seclists.org/fulldisclosure/2010/Mar/519 – Dog eat cat world Aug 24 '11 at 18:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.