0

This has been asked a bunch of times. I am just curious to see if the below code provides a fairly significant level of security.

Are there any other cases I should consider?

Below is just an example; please ignore any syntax problems; I'm looking for insight into the security aspect of the code.

Few assumptions:

  1. If user does nothing in 5 seconds, log him out.
  2. If user is not coming from somePage.php log him out.
  3. If users ip address changes, log him out.

Code:

<?php
session_start();
$time = time();
$ip = $_SERVER['REMOTE_ADDR'];

if ($time - $_SESSION['time'] > 5)
{
    //function to log out user...//echo "logged Out,Time";
}
elseif ($ip !== $_SESSION['ip'])
{
    //function to log out user...//echo "logged out,IP";
}
elseif ($_SERVER['HTTP_REFERER'] !== "http://server.com/somePage.php")
{
    //function to log out user...//echo "logged out,Refer";
}
else
{
   //do sensitive stuff
}
$_SESSION['time'] = $time;
$_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
?>
  • please explain downvote – bart2puck Mar 24 '14 at 15:53
  • I didn't downvote you, but don't you want to check to see if the session is even valid? 5 seconds? Are you expecting rapid clicking? – user11869 Mar 24 '14 at 15:56
  • 5 seconds was just my testing example.My question is a bit cloudy i guess, I was looking for an answer like "yes these are good, but don't forget to check x,y,z also" or "no this is a terrible idea, try ABC" – bart2puck Mar 24 '14 at 15:58
  • It all depends is the problem. Your question has no specifics. No attempt to say what you're trying to prevent. IP might be overkill if you're expecting people to move around...bad UX to make them relogin all the time if it's a mobile app. Referrer can be spoofed...it isn't really adding anything. It all depends.... – user11869 Mar 24 '14 at 16:14
1

see if the below code provides a fairly significant level of security

It's difficult to give suggestions when it's not clear what kind of attacks you're trying to protect against.

My answer is that these settings would be annoying.

$_SERVER['HTTP_REFERER'] !== "http://server.com/somePage.php"

This would prevent people from bookmarking your website effectively. It could also be a denial of service vector if someone uses Cross Site Request Forgery to redirect your users to this page with the wrong referrer; effectively logging your users out each time they visit a poisoned page.

$ip !== $_SESSION['ip']

This would make it difficult to use your site in conjunction with an anonymity network such as Tor. Nothing is more annoying that getting logged out every 10 minutes because your IP address "changed".

$time - $_SESSION['time'] > 5

This is very much subjective. It is really down to the user to protect his computer if he leaves it unattended, you don't know the user's real life situation.

  • good feedback thank you. is there anything you recommend that i do check? – bart2puck Mar 24 '14 at 16:19
1

I agree with user2675345 : binding the session to the IP is probably not a good idea. Have a look here for the reasons.

However you could bind the session the HTTP_USER_AGENT. See Session Hijacking here for a complete solution. Make sure to add a random salt to the string.

You can also have a look at this answer on SO for a complete list of generic ideas to make your session more secure.

Note to mitigate xss use HttpOnly cookies.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.