I'm writing a new website in PHP and I will be using cookies to track user session data. Before I finalize the design, I want to make sure that the site is not vulnerable to attacks. I have written a list of attack methods and came up with countermeasures for each one. Can anyone think of any more attack methods and if so also propose suitable counter measures?
A list of all attack methods I could think of:
- Guess/bruteforce session cookie
- Steal session cookie (e.g. if the attacker saves the session cookie to USB)
- Cross-site scripting
- Phishing (session fixation)
- SQL injection
- HTTP header injection
It should be noted that I will be using my own database to store session info - not the PHP standard session functions. When I detect an attack I will run a function called
warn_and_halt() which will log the attack and inform the sysadmin, then halt the session under attack.
My countermeasures for each of the above attack types are:
Rather than using a large integer for the session ID stored in the cookie, I will generate my own random number and then hash it with something like SHA-1 to make it a little harder to guess. Of course the session ID may not be unique if created this way, so I will have to check all of the other session IDs in the database and regenerate if the newly generated session ID already exists. I am confident with this measure.
I am assuming the USB will be taken to another computer and the session cookie loaded into another browser. I will be logging the user agent (browser name) for each session. If the user agent changes during the session then I will
warn_and_halt(). I have read of people using the IP address to validate the session ID, but I don't think I will be using this at all since IP addresses can change during a session for completely innocent reasons - for example if the user's router resets and negotiates a new IP with their ISP. Can anyone suggest more countermeasures here?
I will set the session cookie as HTTPonly and also check the domain of incoming cookies. There is not much of what can be done to prevent that happening on a browser in my view - the browser may choose not to comply with the HTTPonly flag - nothing I can do there! Does anyone know a better way to prevent XSS?
I envisage phishing to happen by user "bad" logging into my site, then emailing a link such as
SQL injection is a problem with much larger scope than stealing session IDs, but I will be countering it in general by always escaping the incoming data (including from cookies) and by filtering out any wrong characters with regex. I think I have this one pretty well covered.
I just learned about HTTP header injection. Nevertheless, it seems pretty easy to counter - just escape the incoming header fields - especially for carriage returns and validate incoming headers.
So those are all of the attacks and countermeasures I could think of (after a fair bit of reading online). If you see any that I have missed, please respond. If you see that any of my countermeasures is insufficient, please tell.