session security in php

Question

This has been asked a bunch of times. I am just curious to see if the below code provides a fairly significant level of security.

Are there any other cases I should consider?

Below is just an example; please ignore any syntax problems; I'm looking for insight into the security aspect of the code.

Few assumptions:

1. If user does nothing in 5 seconds, log him out.
2. If user is not coming from somePage.php log him out.
3. If users ip address changes, log him out.

Code:

<?php
session_start();
$time = time();
$ip = $_SERVER['REMOTE_ADDR'];

if ($time - $_SESSION['time'] > 5)
{
    //function to log out user...//echo "logged Out,Time";
}
elseif ($ip !== $_SESSION['ip'])
{
    //function to log out user...//echo "logged out,IP";
}
elseif ($_SERVER['HTTP_REFERER'] !== "http://server.com/somePage.php")
{
    //function to log out user...//echo "logged out,Refer";
}
else
{
   //do sensitive stuff
}
$_SESSION['time'] = $time;
$_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
?>

Answer 1

see if the below code provides a fairly significant level of security

It's difficult to give suggestions when it's not clear what kind of attacks you're trying to protect against.

My answer is that these settings would be annoying.

$_SERVER['HTTP_REFERER'] !== "http://server.com/somePage.php"

This would prevent people from bookmarking your website effectively. It could also be a denial of service vector if someone uses Cross Site Request Forgery to redirect your users to this page with the wrong referrer; effectively logging your users out each time they visit a poisoned page.

$ip !== $_SESSION['ip']

This would make it difficult to use your site in conjunction with an anonymity network such as Tor. Nothing is more annoying that getting logged out every 10 minutes because your IP address "changed".

$time - $_SESSION['time'] > 5

This is very much subjective. It is really down to the user to protect his computer if he leaves it unattended, you don't know the user's real life situation.

Answer 2

I agree with user2675345 : binding the session to the IP is probably not a good idea. Have a look here for the reasons.

However you could bind the session the HTTP_USER_AGENT. See Session Hijacking here for a complete solution. Make sure to add a random salt to the string.

You can also have a look at this answer on SO for a complete list of generic ideas to make your session more secure.

Note to mitigate xss use HttpOnly cookies.