5

I have a PHP website and my question is:

If someone manages to steal my users' cookies via an XSS attack,
is it enough for him to be identified as the user?
Or does his IP also have to be the same as the logged in user?

My php.ini has session.use-cookies and session.use-only-cookies set to true

10

Cookies only; of course, there's nothing preventing you from this:

if (empty($_SESSION['ip']) {
  $_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
} else {
  if ($_SESSION['ip'] != $_SERVER['REMOTE_ADDR']) {
    // IP changed
  }
}

Note that identifying a user by IP address is only a stopgap measure, and I wouldn't consider it relevant to security - e.g. large organizations use NAT, so multiple computers will appear as having the same address to the Internet at large. Conversely, e.g. mobile users' IP address can change often, so don't automatically assume "same IP address == same user, different IP address == different user".

Further concerns: IPv4 and IPv6 dual-stack, IPv6 Privacy Extensions, etc.

  • 3
    I had this implementation "issue" earlier, and someone pointed out to me a problem they had issues with AOL customers, when they identified the HTTP-session with both cookie and ip. It turned out that every AOL user changed IP for each HTTP request, due to some outgoing transparent proxy. – Dog eat cat world Aug 24 '11 at 18:30
  • Yep, guess I'll stick with the default configuration, thanks a lot for the explanation though. – fiftyeight Aug 24 '11 at 22:49
6

A PHP 'SESSION' cookie does not incorporate IP address information out of the box. It is possible to associate it with that information, as Piskvor showed, but doing so may break the application for some users. See OWASP's discussion of the possible problems that IP address binding can cause.

  • 2
    This is a bit of technical detail about PHP session cookie generation. In the generation of the PHPSessionID, it uses the REMOTE_ADDR, if available. This is however only part of the "random" entropy. Fun fact: Given a few factors, you can predict PHP sessionid's :) – Dog eat cat world Aug 24 '11 at 18:34
  • 1
    Just to be clear, it's using REMOTE_ADDR to generate the pseudo-random identifier, it's not incorporating REMOTE_ADDR in any way that allows the PHP programmer to compare current REMOTE_ADDR against the original REMOTE_ADDR used at session creation time, correct? – gowenfawr Aug 24 '11 at 18:42
  • 1
    correct. Have a look here: seclists.org/fulldisclosure/2010/Mar/519 – Dog eat cat world Aug 24 '11 at 18:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.