I have a problem and I'm not immediately sure how to go about resolving it.

I have been building a secured login system on a HTTPS server (with a grade of "A" by SSL-labs, if that's worth anything ), and it works fine, however today it is refusing to log me in, with some debugging I have found something very odd (in my view).

I have some serious issues with session handling on the website, the different pages use the same session data (of course) and the same session /cookie settings, and they pass the information between each other correctly, BUT the behaviour of my browser appears to be as if there are two browsers visiting the same websites, using the same session data.

Symptoms - Because I have been having inconsistencies with page generated session content (unique hash token) not fitting the same data saved in the login form (as a $_POST value), I was finding that as there is only one line in the whole site that sets the value of the session, this line must be running twice. So I set a counter value in the session, as session['counter']. My problem is specifically with this:

Login page:

Opens page,  
session hash-string is generated and saved to the post form.
session counter = counter + 1;
Form is filled in.

Login auth' page:

fails to verify the posted hash-string is the same as the session hash
 string, despite there being no other cause for the session values to
 change (well there must be, but I can't see it!)  

But, then going back to the Login Page I see that the counter = last value + 2! Also, the counter value recorded on the session file saved on the server is always +1 to the value displayed on the login page.

Some images:

enter image description here

Please note that this is above the HTML output and is the last place on the code where any SESSION data is edited.

Output :

enter image description here

Please note the number relating to the counter in image 1.

enter image description here

My session file, this file relates to this specific browser session and only 1 session file as I am the only browser on the site.

enter image description here

The string CheckDrop is the hash value to compare but the counter is at 12 rather than 11, which is displayed in image 2 above.

  • My site is HTTPS authed although this work is on a subdomain.

  • This type of issue has never occurred before for me.

  • This issue has been happening for the last 3 hours but inconsistently, it magically worked for about 40 minutes earlier today (just before posting this post). but I had done nothing I could see as changing the environment.

  • I have previously compared phpinfo data and it all looks correct at point of browser output. It does not seem to be caused by my settings.

  • It happens on different browsers on my PC.

I would like to ask, obviously, any ideas why this is occurring? But more specifically to this StackExchange, How can I confirm or check that it is not some form of MITM or other unwanted interference? I have a fear that this is someone/something in the middle of the route from server to PC, but would like to know how I can check if so and any other help in confirming the connection is secure.

Note: I posted a question on a similar over topic on StackOverflow, earlier, but this question on here is more specifically about the session counter anomaly. and about if it is indicative of interference.

  • 2
    This really belongs on Stack Overflow. Here not everyone is a programmer. Here we're just concerned about keeping things safe. – Robert Mennell Nov 17 '15 at 21:24
  • I'm not seeing a MITM issue, but a browser making multiple connections – schroeder Nov 17 '15 at 21:26
  • I do entirely appreciate that @RobertMennell , and sorry if this is well out the ballpark, but I was looking for a confirm or denial of if this behaviour was indicative of interference . I have been looking and looking at this code and there's so little to interfere with that I can't see it as a code issue, hence other options such as something piggybacking on my browser or MITM? – Martin Nov 17 '15 at 21:28
  • But @schroeder if I am the only browser and I know about only 50% of those connections, where do the other 50% come from and how do they occur? That's my question. – Martin Nov 17 '15 at 21:30
  • Martin - I don't think you only know about half the connections. I think that (sometimes) you're evaluating that PHP code twice to double-increment the counter. I bet that the value only unexpectedly increments when you are logging in to the site and not when you're leaving the site idle. Even if someone is somehow interfering with your connection, they can't do anything besides cause it to fail as SSL works. Figuring out why the counter is double incrementing is better suited for StackOverflow. – Neil Smithline Nov 17 '15 at 21:52