Should i worry about securing PHP sessions for my users? How do hackers steal the sessions?

The information users of my site can view is not at all sensitive and if viewed or modified by a hacker wouldn't really harm users, but would inconvenience them.

Is storing and checking the IP really necessary? How useful is user agent checking? I assume it would be as easy as sending a user agent header.

  • 1
    Here's a few things to think about with PHP sessions: 1. Session data, by default, is stored as "serialized" plain text. This means that all data can easily be read by anyone that either has access to the files or can pull them using some LFI exploit. Using a custom session handler with encryption is recommended. 2. Change the php.ini to make the session cookies HTTP Only. This is disabled by default. 3. Checking by IP will help 90% of the time, but consider the users - if they're coming from a firewall, they'll all be the same IP. 4. And yes, please use SSL :) – enygma Oct 3 '14 at 14:17

The session is just a random generated token which is impractical to guess.

There are many scenarios in which stealing sessions are possible such as Cross Site Scripting (XSS) or by sniffing the traffic if the attacker has access to a networkin node between client and server.

To solve the XSS issue you need to not have validation issues. This means proper checking of user input and proper encoding if shown back to the user (output validation).

You MUST use SSL if you want to mitigate attackers sniffing your client's session tokens.

Checking IP is another layer of defence but might give issues when clients are roaming.

If the attacker can steal the session he can steal the user agent as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.