3

When displaying a page with content only logged in users should see, I simply check

if(isset($_SESSION['hasLoggedIn']))
{
  //show content
}
else
{
  echo 'you must log in';
}

In this article it recommends checking the IP address and browser each time.

$_SESSION['login_string'] = hash('sha512', $password.$ip_address.$user_browser);

Is this necessary? I thought since session variables only existed on the server they are not prone to attack? I kind of don't get why $password is there. If the password is being passed to each page, wouldn't it be easier for the database with the userid/password to be queried, or is the idea that this way the database doesn't need to be queried (which is time consuming)?

3
2

There are other things to consider to get a secure session handling, like using SSL, regeneratig the session id, and more. But to get the login state from the session, it is enough to test if a certain value is set, like you did.

Of course you can store additional information about the user connetion in the session, but password and ip-address are not appropriate. Especially the password should not be stored plaintext on server-side, and that is what you need to check the hash in your example. The ip-address is not a reliable information, it could be dynamic and change during the visit of the user. In this case the user would be denied access, even if he had logged in successfully before.

If you want to store additional information, i would recommend to write this fingerprint into a separate variable like $_SESSION['client_fingerprint']. There is an article from Chris Shiflett (see section: Preventing Impersonation), it shows that there are not many informations appropriate to generate this fingerprint.

2
  • How frequently would the IP address change? If the IP changes every day I think it's still a good idea to check it. Mar 23 '13 at 22:52
  • 1
    I answered my own question. "Most notably, a single user can potentially use a different IP address for each request (as is the case with large ISPs such as AOL)" Mar 23 '13 at 23:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.