EDIT: I changed the title of this post from "How to manage sessions in webapps?" to "How to secure store sessions values in webapps?" as it might have been misleading
In the recent months I happened to encounter interesting scenarios that made me wonder on how to manager web apps sessions.
Some months ago I read about a SQL-Injection in Joomla 3.4 that would allow an attacker to perform a session hijacking. This is possible because Joomla 3.4 stores in the database the value of each user's session that connects to Joomla. What is interesting is that a couple of weeks ago I performed some on a friend's domain he built a loooot of time ago. His web site is so old that he's still using Joomla 1.1. I could immediately find a SQL-Injection in one of the plugin he installed, so I remembered of the session table and I looked for that. I found it, and I tried to show him the effect of the vulnerability. The thing is that .... I couldn't. The values stored in the database are different from the one the browser receives. I checked the Joomla source code and it turns out that Joomla 1.1 generates a pseudo-random number, performs some md5 operations with that number, and sends to the browser the pseudo-random number and stores in the database the result of the md5 operations. In this way I simply couldn't perform a session hijacking at all.
I also tried to inform the Joomla community about this but they don't seem to care about it. To me it seems quite important, a 10 years old software wouldn't allow an attacker to perform a session hijacking in case a SQL-Injection is found while the new version would.
I started to wonder on what would be the best way for managing sessions values.
Why storing them on the database?
Why not simply using what the back-end programming language is providing (like
session_start in php)?
What do you think about it?