0

I have a php and nodejs server. User logs in on the php backend, and, when entering nodejs, the php SID cookie is being passed through a websocket. I further take the session ID, find the session file in php's directory and deserialize it, where I can access data.

Is that safe? The websocket does not use a TLS connection. If not(probably) why, and what are the threats?

0

First off, any kind of sensitive information is supposed to be transmitted via secure channels. In this case it is theoretically possible to capture the session ID using a packet sniffer on your network for the communication is not encrypted, as you say. The Wireshark tool even has a decent filter to make it easier to debug WebSockets communication. However, you say your application accesses data inside PHP's session files. What kind of further attack is conductible depends on your application, e.g. if you print out the file contents or a part of. According to the information you provided, it might be possible to forge other users' data stored in their respective session file by manipulating the session ID if the WebSocket receiver (Node.js in your case) is available not only to your PHP application (e.g. a port is exposed to local network or the Internet). Some more details would help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.