Take the 2-minute tour ×
Code Review Stack Exchange is a question and answer site for peer programmer code reviews. It's 100% free, no registration required.

I am having a few issues about a session class that I found after reading it a lots of times,

Here is the class :

class SessionManager{
static function sessionStart($name, $limit = 0, $path = '/', $domain = null, $secure = null)
{
$https = isset($secure) ? $secure : isset($_SERVER['HTTPS']);
session_set_cookie_params($limit, $path, $domain, $https, true);
session_start();
if(self::validateSession())
{

    if(!self::preventHijacking())
    {

        $_SESSION = array();
        $_SESSION['IPaddress'] = $_SERVER['REMOTE_ADDR'];
        $_SESSION['userAgent'] = $_SERVER['HTTP_USER_AGENT'];
        self::regenerateSession();


    }elseif(rand(1, 100) <= 5){
        self::regenerateSession();
    }
}else{
    $_SESSION = array();
    session_destroy();
    session_start();
}
}

 static protected function preventHijacking()
 {
      if(!isset($_SESSION['IPaddress']) || !isset($_SESSION['userAgent']))
           return false;

      if ($_SESSION['IPaddress'] != $_SERVER['REMOTE_ADDR'])
           return false;

      if( $_SESSION['userAgent'] != $_SERVER['HTTP_USER_AGENT'])
           return false;

      return true;
 }
 static function regenerateSession()
 {

      if(isset($_SESSION['OBSOLETE']) || $_SESSION['OBSOLETE'] == true)
           return;


      $_SESSION['OBSOLETE'] = true;
      $_SESSION['EXPIRES'] = time() + 10;
      session_regenerate_id(false);
      $newSession = session_id();
      session_write_close();
      session_id($newSession);
      session_start();
      unset($_SESSION['OBSOLETE']);
      unset($_SESSION['EXPIRES']);
 }
 static protected function validateSession()
 {
      if( isset($_SESSION['OBSOLETE']) && !isset($_SESSION['EXPIRES']) )
           return false;

      if(isset($_SESSION['EXPIRES']) && $_SESSION['EXPIRES'] < time())
           return false;

      return true;
 }

}

My concerns are:

  1. Security [Fixation,Hijacking] , is the above a bulletproof ?

  2. Usability I am unable to understand how to use the above code in terms of providing the user an authorized access as long not logging out was performed i.e after secure logging should I just keep calling session_start(parameters); and when logging out call session_destroy() [In addition to make the class functions public/protected .. ]; ?

  3. I am unable to convince myself that this will not cause problems when redirecting between pages such as after submitting a form(like when pressing the back button [I am not attending to rely on JavaScript]),disconnecting and reconnecting

  4. How do I integrate secure cookies mechanism with above code while maintaining a complete secure environment and compatibility with SECTION 3

  5. Will the above code be compatible with these settings:

    session.cookie_httponly = 1 
    session.session.use_only_cookies = 1
    session.entropy_file = "/dev/urandom" 
    session.cookie_lifetime = 0  
    session.cookie_secure = 1 
    
  6. Should I integrate DB functionality to provide more security?,

  7. As for AJAX,the above code is built to response to multiple Sessions requests,are there any related security issues about this ?

Original source http://blog.teamtreehouse.com/how-to-create-bulletproof-sessions

I will be very happy if you could let me know your own thoughts,improvements,concerns about the above code to drive it into maximum security.

share|improve this question
    
Someone please? –  user2046198 Feb 6 '13 at 12:13
    
Please add a link to the source. I guess there is an article about it, or did you copy it from an other project? –  mnhg Feb 6 '13 at 12:21
    
Your correct,I should have put the source link: blog.teamtreehouse.com/how-to-create-bulletproof-sessions –  user2046198 Feb 6 '13 at 12:55
add comment

1 Answer 1

The comments to the article are quite interesting:

http://code.google.com/p/phpsessionmanager/

The updated version for some special cases and small documentation.

Nevertheless, there are some disadvantage listed in the comments, too.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.