Pro PHP Security: From Application Security Principles to the Implementation of XSS Defenses, Second Edition

Summary

We have continued our survey of potential threats to the safety of your users' data by abusers who take advantage of vulnerabilities in your scripts, dealing in this chapter with abuse of sessions.

After describing exactly what sessions are and how they work, we discussed two common kinds of session abuse, either hijacking or fixating them. In both cases, the abusers are attempting to use someone else's authorized access to carry out their own nefarious purposes.

We then discussed a series of possible solutions:

• Protect your sessions with SSL or TLS, which will encrypt the entire transaction.
• Insist on using cookies rather than $_GET variables.
• Time sessions out.
• Regenerate session IDs when users change status.
• Rely on tested code abstraction. ...