php-sessions

How To Secure PHP Sessions?

My notes about how to secure PHP Sessions, what is session hijacking, and so on.

Session Hijacking

• The attacker steals the active session of the user.

Session Fixation

• Imagine the attacker steals your session ID while in the Guest. Then you log in to your account. If the application doesn’t generate the session id again, you give direct auth to the attacker.

Defend Session attacks in PHP

• IP match control
• User-agent control
• Limit the access, if the last access is more than x hours, destroy the session.
• Configure cookie options (secure, httponly, samesite)
• For preventing session fixation, use the session_regenerate_id() function after login.
• Apply guest middleware

Setting HTTP Only Cookies In PHP

• Setting HTTP only true provides to prevent access on the client side that cookies if the browser supports it.

ini_set( 'session.cookie_httponly', 1 );

OR (PHP 8 +)

setcookie( $name, $value, httponly:true )

OR

session_start(['cookie_httponly' => true]);

Setting Secure Cookies In PHP

• The browser will not send a cookie with the secure attribute set over an unencrypted HTTP request.

session.cookie_secure = True

OR set it true with the set session_set_cookie_params function

  session_set_cookie_params([
      'lifetime' => 'YOUR_LIFE_TIME_VALUE',
      'path' => 'YOUR_PATH',
      'domain' => 'YOUR_DOMAIN',
      'secure' => true, // set it true for secure
      'httponly' => true, // set it true for secure
      'samesite' => 'YOUR_SAME_SITE_VALUE'
  ]);

Same Site Cookie In PHP

• HTTP response header allows you to declare if your cookie should be restricted to a first-party or same-site context.

Basically, edit with session_set_cookie_params function. (Lax, Strict and etc.)

For a better understanding of the types of the same site attributes, please visit this link.

ini_set(‘session.cookie_samesite’, ‘HERE_WRITE_VALUE’);

OR (you can set it with this function setting up the options)

References:

• https://owasp.org/www-community/controls/SecureCookieAttribute
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite

Continue Reading 😃

You can click on this link to access the rest of this article or other articles in the article group.

Recommended Articles;

PHP Loops — Which is faster?

PHP Magic Methods Explained

JIT Compiler in PHP