I have a problem and I'm not immediately sure how to go about resolving it.
I have been building a secured login system on a HTTPS server (with a grade of "A" by SSL-labs, if that's worth anything ), and it works fine, however today it is refusing to log me in, with some debugging I have found something very odd (in my view).
I have some serious issues with session handling on the website, the different pages use the same session data (of course) and the same session /cookie settings, and they pass the information between each other correctly, BUT the behaviour of my browser appears to be as if there are two browsers visiting the same websites, using the same session data.
Symptoms - Because I have been having inconsistencies with page generated session content (unique hash token) not fitting the same data saved in the login form (as a
$_POST value), I was finding that as there is only one line in the whole site that sets the value of the session, this line must be running twice. So I set a counter value in the session, as
session['counter']. My problem is specifically with this:
Opens page, session hash-string is generated and saved to the post form. session counter = counter + 1; Form is filled in.
Login auth' page:
fails to verify the posted hash-string is the same as the session hash string, despite there being no other cause for the session values to change (well there must be, but I can't see it!)
But, then going back to the Login Page I see that the counter = last value + 2! Also, the counter value recorded on the session file saved on the server is always +1 to the value displayed on the login page.
Please note that this is above the HTML output and is the last place on the code where any SESSION data is edited.
Please note the number relating to the counter in image 1.
My session file, this file relates to this specific browser session and only 1 session file as I am the only browser on the site.
The string CheckDrop is the hash value to compare but the counter is at 12 rather than 11, which is displayed in image 2 above.
My site is HTTPS authed although this work is on a subdomain.
This type of issue has never occurred before for me.
This issue has been happening for the last 3 hours but inconsistently, it magically worked for about 40 minutes earlier today (just before posting this post). but I had done nothing I could see as changing the environment.
I have previously compared phpinfo data and it all looks correct at point of browser output. It does not seem to be caused by my settings.
It happens on different browsers on my PC.
I would like to ask, obviously, any ideas why this is occurring? But more specifically to this StackExchange, How can I confirm or check that it is not some form of MITM or other unwanted interference? I have a fear that this is someone/something in the middle of the route from server to PC, but would like to know how I can check if so and any other help in confirming the connection is secure.
Note: I posted a question on a similar over topic on StackOverflow, earlier, but this question on here is more specifically about the session counter anomaly. and about if it is indicative of interference.