10

Where is the information in the fields of a session stored? If I, for instance, store in a session something like $_SESSION['foo'] = 'bar'. Where is "bar" stored?

If I store an object of a class, in wich way is it stored? Like $_SESSION['kart'] = new Kart(10). Could someone get the information stored in that class? How?

Could the legitimate owner of that session modify the value of the field "foo"?

And, could someone change the value of the field "foo" in an already created session of other user?

Improve this question
2
  • This doesnt store the object, but only object data. By having access to PHP it is possible to list folder with sessions and alter any of the file or extract that list from the Apache / fast-cgi process over the time. There is no way you can expect any e-commerce security with PHP by default.
    – Andrew Smith
    Aug 22, 2012 at 8:02
  • If your PHP installation includes the Suhosin security patch (which is strongly recommended), then the session data will be encrypted.
    – SDC
    Aug 24, 2012 at 11:10

2 Answers 2

Reset to default
8

This depends on the webserver used. If we take PHP on Unix as an example it may store the session on the filesystem in the /tmp folder. It creates a file here with the name of the users session ID prefixed with sess_ (Example: /tmp/sess_9gk8f055hd61qll6a8pjpje2n2).The contents of the session can be optionally encrypted before being placed on the browser. For Apache sessions (not necessarily PHP) you may use the mod_session_crypto module (Read more here).

The owner of the session can not change the session variables as he feels like unless the application allows him to do it. The application logic has to provide means to change the session in order for the user to change the variables.

The session object is never transmitted to the client and only a reference to the session (e.g. PHPSESSID) is passed to the client. The session ID should have high entropy and minimum 16 bytes of length in order to be very hard to guess. See OWASP Top 10 - Broken authentication and session management for more information about that. Also see this OWASP Cheat sheet for specific information on how to secure sessions.

Attacks against session storage:

If there exists a flaw like for example LFI (Local File Inclusion) it may be possible for an attacker to read their own and other users session objects by including the file on the file system. For example if the following example worked I could possibly read my own session data: 

http://<victim>/?page=../../../../../../../../tmp/sess_<my sessionid>
Improve this answer
1
  • I added other question: "If I store an object of a class, in wich way is it stored? Like $_SESSION['kart'] = new Kart(10). Could someone get the information stored in that class? How?" Could you explain how the data is stored in these documents?
    – eversor
    Aug 22, 2012 at 12:46
1

Check your php.ini or use info.php to find the session.save_path enter image description here

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .