I have a PHP website and my question is:

If someone manages to steal my users' cookies via an XSS attack,
is it enough for him to be identified as the user?
Or does his IP also have to be the same as the logged in user?

My php.ini has session.use-cookies and session.use-only-cookies set to true

  • 2
    If your looking to help protect cookie sessions, I'd reccomend looking at HTTPOnly cookies and Session Fixation Protection (for post login). owasp.org/index.php/Session_Fixation_Protection Of course both not full proof, but helps add layers to security. Commented Aug 24, 2011 at 16:43

2 Answers 2


Cookies only; of course, there's nothing preventing you from this:

if (empty($_SESSION['ip']) {
} else {
  if ($_SESSION['ip'] != $_SERVER['REMOTE_ADDR']) {
    // IP changed

Note that identifying a user by IP address is only a stopgap measure, and I wouldn't consider it relevant to security - e.g. large organizations use NAT, so multiple computers will appear as having the same address to the Internet at large. Conversely, e.g. mobile users' IP address can change often, so don't automatically assume "same IP address == same user, different IP address == different user".

Further concerns: IPv4 and IPv6 dual-stack, IPv6 Privacy Extensions, etc.

  • 3
    I had this implementation "issue" earlier, and someone pointed out to me a problem they had issues with AOL customers, when they identified the HTTP-session with both cookie and ip. It turned out that every AOL user changed IP for each HTTP request, due to some outgoing transparent proxy. Commented Aug 24, 2011 at 18:30
  • Yep, guess I'll stick with the default configuration, thanks a lot for the explanation though.
    – fiftyeight
    Commented Aug 24, 2011 at 22:49

A PHP 'SESSION' cookie does not incorporate IP address information out of the box. It is possible to associate it with that information, as Piskvor showed, but doing so may break the application for some users. See OWASP's discussion of the possible problems that IP address binding can cause.

  • 2
    This is a bit of technical detail about PHP session cookie generation. In the generation of the PHPSessionID, it uses the REMOTE_ADDR, if available. This is however only part of the "random" entropy. Fun fact: Given a few factors, you can predict PHP sessionid's :) Commented Aug 24, 2011 at 18:34
  • 1
    Just to be clear, it's using REMOTE_ADDR to generate the pseudo-random identifier, it's not incorporating REMOTE_ADDR in any way that allows the PHP programmer to compare current REMOTE_ADDR against the original REMOTE_ADDR used at session creation time, correct?
    – gowenfawr
    Commented Aug 24, 2011 at 18:42
  • 1
    correct. Have a look here: seclists.org/fulldisclosure/2010/Mar/519 Commented Aug 24, 2011 at 18:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .