I'm writing a new website with php and I will be using cookies to track user session data. Before I finalise the design I want to make sure that the site is not vulnerable to attacks. I have written a list of attack methods and come up with counter measures for each one. Can anyone think of any more attack methods and if so also propose suitable counter measures?

a list of all attack methods I could think of:

1. guess/bruteforce session cookie
2. steal session cookie (eg if the attacker saves the session cookie to usb)
3. cross site scripting
4. phishing (session fixation)
5. sql injection
6. http header injection

It should be noted that I will be using my own database to store session info - not the php standard session functions. When I detect an attack I will run a function called warn_and_halt() which will log the attack and inform the sysadmin, then halt the session under attack.

My counter measures for each of the above attack types are:

1. rather than using a large integer for the session id stored in the cookie, i will generate my own random number then hash it with something like sha1 to make it a little harder to guess. of course the session id may not be unique if created this way so i will have to check all of the other session ids in the database and regenerate if the newly generated session id already exists. im confident with this measure.
2. im assuming the usb will be taken to another computer and the session cookie loaded into another browser. i will be logging the user agent (browser name) for each session. if the user agent changes during the session then i will warn_and_halt(). i have read of people using the ip address to validate the session id, however i don't think i will be using this at all since ip addresses can change during a session for completely innocent reasons - for example if the user's router resets and negotiates a new ip with their isp. can anyone suggest more counter measures here?
3. i will set the session cookie as httponly and also check the domain of incoming cookies. there is not much which can be done to prevent what happens on a browser in my view - the browser may choose not to comply with the httponly flag - nothing i can do there! does anyone know of a better way to prevent xss?
4. i envisage phishing to happen by user BAD logging in to my site, then emailing a link such as <a href='javascript:void(0);' onclick="document.cookie='sessionid=xxxx';document.location='http://mywebsite/'"> to user OBLIVIOUS. this will set a session cookie without OBLIVIOUS knowing it. then OBLIVIOUS will enter their personal information and BAM - user BAD has this info! i think most browsers will not allow the domain of the new cookie to be set as mywebsite so OBLIVIOUS is pretty safe. nevertheless i will be checking the incoming domain of each cookie to make sure it is for my website. i will definitely be using cookies, rather than GET or POST to store the session id. also i will counter session fixation by changing the session id for every page visited.
5. sql injection is a problem with much larger scope than stealing session ids, but i will be countering it in general by always escaping the incoming data (including from cookies) and by filtering out any wrong characters with regex. i think i have this one pretty well covered.
6. i only just learned about http header injection. nevertheless it seems pretty easy to counter - just escape the incoming header fields - especially for carriage returns and validate incoming headers.

so those are all of the attacks and counter measures i could think of (after a fair bit of reading online...). if you see any that i have missed, please respond. and if you see that any of my counter measures are insufficient, please do tell :)

I'm writing a new website in PHP and I will be using cookies to track user session data. Before I finalize the design, I want to make sure that the site is not vulnerable to attacks. I have written a list of attack methods and came up with countermeasures for each one. Can anyone think of any more attack methods and if so also propose suitable counter measures?

A list of all attack methods I could think of:

1. Guess/bruteforce session cookie
2. Steal session cookie (e.g. if the attacker saves the session cookie to USB)
3. Cross-site scripting
4. Phishing (session fixation)
5. SQL injection
6. HTTP header injection

It should be noted that I will be using my own database to store session info - not the PHP standard session functions. When I detect an attack I will run a function called warn_and_halt() which will log the attack and inform the sysadmin, then halt the session under attack.

My countermeasures for each of the above attack types are:

1. Rather than using a large integer for the session ID stored in the cookie, I will generate my own random number and then hash it with something like SHA-1 to make it a little harder to guess. Of course the session ID may not be unique if created this way, so I will have to check all of the other session IDs in the database and regenerate if the newly generated session ID already exists. I am confident with this measure.

2. I am assuming the USB will be taken to another computer and the session cookie loaded into another browser. I will be logging the user agent (browser name) for each session. If the user agent changes during the session then I will warn_and_halt(). I have read of people using the IP address to validate the session ID, but I don't think I will be using this at all since IP addresses can change during a session for completely innocent reasons - for example if the user's router resets and negotiates a new IP with their ISP. Can anyone suggest more countermeasures here?

3. I will set the session cookie as HTTPonly and also check the domain of incoming cookies. There is not much of what can be done to prevent that happening on a browser in my view - the browser may choose not to comply with the HTTPonly flag - nothing I can do there! Does anyone know a better way to prevent XSS?

4. I envisage phishing to happen by user "bad" logging into my site, then emailing a link such as <a href='javascript:void(0);' onclick="document.cookie='sessionid=xxxx';document.location='http://mywebsite/'"> to user "oblivious". This will set a session cookie without "oblivious" knowing it. Then "oblivious" will enter their personal information and user "bad" has this info! I think most browsers will not allow the domain of the new cookie to be set as mywebsite, so "oblivious" is pretty safe. Nevertheless, I will be checking the incoming domain of each cookie to make sure it is for my website. I will definitely use cookies, rather than GET or POST to store the session ID. Also, I will counter session fixation by changing the session ID for every page visited.

5. SQL injection is a problem with much larger scope than stealing session IDs, but I will be countering it in general by always escaping the incoming data (including from cookies) and by filtering out any wrong characters with regex. I think I have this one pretty well covered.

6. I just learned about HTTP header injection. Nevertheless, it seems pretty easy to counter - just escape the incoming header fields - especially for carriage returns and validate incoming headers.

So those are all of the attacks and countermeasures I could think of (after a fair bit of reading online). If you see any that I have missed, please respond. If you see that any of my countermeasures is insufficient, please tell.

im writing a new website with php and i will be using cookies to track user's session data. before i finalise the design i want to make sure that the site is not vulnerable to attacks. i have written a list of attack methods and come up with counter measures for each one. can anyone think of any more attack methods and if so also propose suitable counter measures?

a list of all attack methods i could think of:

it should be noted that i will be using my own database to store session info - not the php standard session functions. when i detect an attack i will run a function called warn_and_halt() which will log the attack and inform the sysadmin, then halt the session under attack.

my counter measures for each of the above attack types are:

I'm writing a new website with php and I will be using cookies to track user session data. Before I finalise the design I want to make sure that the site is not vulnerable to attacks. I have written a list of attack methods and come up with counter measures for each one. Can anyone think of any more attack methods and if so also propose suitable counter measures?

a list of all attack methods I could think of:

It should be noted that I will be using my own database to store session info - not the php standard session functions. When I detect an attack I will run a function called warn_and_halt() which will log the attack and inform the sysadmin, then halt the session under attack.

My counter measures for each of the above attack types are: