Few concerns about specific session class

Question

I am having a few issues about a session class that I found after reading it a lots of times,

Here is the class :

class SessionManager{
static function sessionStart($name, $limit = 0, $path = '/', $domain = null, $secure = null)
{
$https = isset($secure) ? $secure : isset($_SERVER['HTTPS']);
session_set_cookie_params($limit, $path, $domain, $https, true);
session_start();
if(self::validateSession())
{

    if(!self::preventHijacking())
    {

        $_SESSION = array();
        $_SESSION['IPaddress'] = $_SERVER['REMOTE_ADDR'];
        $_SESSION['userAgent'] = $_SERVER['HTTP_USER_AGENT'];
        self::regenerateSession();


    }elseif(rand(1, 100) <= 5){
        self::regenerateSession();
    }
}else{
    $_SESSION = array();
    session_destroy();
    session_start();
}
}

 static protected function preventHijacking()
 {
      if(!isset($_SESSION['IPaddress']) || !isset($_SESSION['userAgent']))
           return false;

      if ($_SESSION['IPaddress'] != $_SERVER['REMOTE_ADDR'])
           return false;

      if( $_SESSION['userAgent'] != $_SERVER['HTTP_USER_AGENT'])
           return false;

      return true;
 }
 static function regenerateSession()
 {

      if(isset($_SESSION['OBSOLETE']) || $_SESSION['OBSOLETE'] == true)
           return;


      $_SESSION['OBSOLETE'] = true;
      $_SESSION['EXPIRES'] = time() + 10;
      session_regenerate_id(false);
      $newSession = session_id();
      session_write_close();
      session_id($newSession);
      session_start();
      unset($_SESSION['OBSOLETE']);
      unset($_SESSION['EXPIRES']);
 }
 static protected function validateSession()
 {
      if( isset($_SESSION['OBSOLETE']) && !isset($_SESSION['EXPIRES']) )
           return false;

      if(isset($_SESSION['EXPIRES']) && $_SESSION['EXPIRES'] < time())
           return false;

      return true;
 }

}

My concerns are:

1. Security [Fixation,Hijacking] , is the above a bulletproof ?

2. Usability I am unable to understand how to use the above code in terms of providing the user an authorized access as long not logging out was performed i.e after secure logging should I just keep calling session_start(parameters); and when logging out call session_destroy() [In addition to make the class functions public/protected .. ]; ?

3. I am unable to convince myself that this will not cause problems when redirecting between pages such as after submitting a form(like when pressing the back button [I am not attending to rely on JavaScript]),disconnecting and reconnecting

4. How do I integrate secure cookies mechanism with above code while maintaining a complete secure environment and compatibility with SECTION 3

5. Will the above code be compatible with these settings:

   session.cookie_httponly = 1 
   session.session.use_only_cookies = 1
   session.entropy_file = "/dev/urandom" 
   session.cookie_lifetime = 0  
   session.cookie_secure = 1 
   

6. Should I integrate DB functionality to provide more security?,

7. As for AJAX,the above code is built to response to multiple Sessions requests,are there any related security issues about this ?

Original source http://blog.teamtreehouse.com/how-to-create-bulletproof-sessions

I will be very happy if you could let me know your own thoughts,improvements,concerns about the above code to drive it into maximum security.

Answer 1

The comments to the article are quite interesting:

http://code.google.com/p/phpsessionmanager/

The updated version for some special cases and small documentation.

Nevertheless, there are some disadvantage listed in the comments, too.