Code Review Stack Exchange is a question and answer site for peer programmer code reviews. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am having a few issues about a session class that I found after reading it a lots of times,

Here is the class :

class SessionManager{
static function sessionStart($name, $limit = 0, $path = '/', $domain = null, $secure = null)
{
$https = isset($secure) ? $secure : isset($_SERVER['HTTPS']);
session_set_cookie_params($limit, $path, $domain, $https, true);
session_start();
if(self::validateSession())
{

    if(!self::preventHijacking())
    {

        $_SESSION = array();
        $_SESSION['IPaddress'] = $_SERVER['REMOTE_ADDR'];
        $_SESSION['userAgent'] = $_SERVER['HTTP_USER_AGENT'];
        self::regenerateSession();


    }elseif(rand(1, 100) <= 5){
        self::regenerateSession();
    }
}else{
    $_SESSION = array();
    session_destroy();
    session_start();
}
}

 static protected function preventHijacking()
 {
      if(!isset($_SESSION['IPaddress']) || !isset($_SESSION['userAgent']))
           return false;

      if ($_SESSION['IPaddress'] != $_SERVER['REMOTE_ADDR'])
           return false;

      if( $_SESSION['userAgent'] != $_SERVER['HTTP_USER_AGENT'])
           return false;

      return true;
 }
 static function regenerateSession()
 {

      if(isset($_SESSION['OBSOLETE']) || $_SESSION['OBSOLETE'] == true)
           return;


      $_SESSION['OBSOLETE'] = true;
      $_SESSION['EXPIRES'] = time() + 10;
      session_regenerate_id(false);
      $newSession = session_id();
      session_write_close();
      session_id($newSession);
      session_start();
      unset($_SESSION['OBSOLETE']);
      unset($_SESSION['EXPIRES']);
 }
 static protected function validateSession()
 {
      if( isset($_SESSION['OBSOLETE']) && !isset($_SESSION['EXPIRES']) )
           return false;

      if(isset($_SESSION['EXPIRES']) && $_SESSION['EXPIRES'] < time())
           return false;

      return true;
 }

}

My concerns are:

  1. Security [Fixation,Hijacking] , is the above a bulletproof ?

  2. Usability I am unable to understand how to use the above code in terms of providing the user an authorized access as long not logging out was performed i.e after secure logging should I just keep calling session_start(parameters); and when logging out call session_destroy() [In addition to make the class functions public/protected .. ]; ?

  3. I am unable to convince myself that this will not cause problems when redirecting between pages such as after submitting a form(like when pressing the back button [I am not attending to rely on JavaScript]),disconnecting and reconnecting

  4. How do I integrate secure cookies mechanism with above code while maintaining a complete secure environment and compatibility with SECTION 3

  5. Will the above code be compatible with these settings:

    session.cookie_httponly = 1 
    session.session.use_only_cookies = 1
    session.entropy_file = "/dev/urandom" 
    session.cookie_lifetime = 0  
    session.cookie_secure = 1 
    
  6. Should I integrate DB functionality to provide more security?,

  7. As for AJAX,the above code is built to response to multiple Sessions requests,are there any related security issues about this ?

Original source http://blog.teamtreehouse.com/how-to-create-bulletproof-sessions

I will be very happy if you could let me know your own thoughts,improvements,concerns about the above code to drive it into maximum security.

share|improve this question
    
Someone please? – user2046198 Feb 6 '13 at 12:13
    
Please add a link to the source. I guess there is an article about it, or did you copy it from an other project? – mnhg Feb 6 '13 at 12:21
    
Your correct,I should have put the source link: blog.teamtreehouse.com/how-to-create-bulletproof-sessions – user2046198 Feb 6 '13 at 12:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.