Geek Answers Handbook

Are cookies safe for PHP sessions?

I am trying to protect my sessions. While doing some research, I thought that the random PHP-agent PHPSESSID + hash based on the agent and IP code is good enough to protect against theft. What else can you do, really.

I use HTTPS for login. As I understand it, session data from PHP is never sent to the user, but rather is stored on the server side. The client receives the session-only identifier. The session data contains the actual webapp user session, which, in turn, is used to verify that the login is correct. All beautiful and dandy.

However, there is a detail that I cannot find anywhere else. I would like to know if a cookie containing the PHP session id will be automatically marked as safe if I use HTTPS. I did some google searches, but didn't seem to get the correct search bar, because I only find ways to manually send cookies. I would like to know, because if this cookie is sent with clear text, it may compromise some security through man-in-the-middle.

EDIT 1

This add-on is for @ircmaxell

I tried my method, but somehow I still get the cookie when I switch from HTTPS to HTTP. How it should work is as follows. Whenever the server knows that a user session is available, it sets a safe flag. This means that the whole site runs on SSL as soon as you are logged in and refuses to give / use a cookie when you are not using SSL. Or at least this idea.

if ($SysKey['user']['session_id'] != '') { session_set_cookie_params(60*60*24*7, '/', $SysKey['server']['site'], true, true); }

I assume that I need to restore the identifier, since the browser already had a cookie before logging in, but since I can only try it in a few hours, I will ask here before trying

NOTES TO THE DECISION

I just found out that you should set these parameters before starting a session. That was my problem. Now I use two different cookies. One for the regular guest who is sent via http, and the second for registered users who are sent only through ssl.

+6
security php ssl cookies session
source share
2 answers

I think the function you are looking for is session_set_cookie_params(...) . This will allow you to set a secure cookie flag to make it only https.

You can check through: session_get_cookie_params()

+6
source share

Don't even think about moving your own session handler!

The PHP session has been broken many times, and because of this, it has become more secure than ever before. When a new number is found, it will be fixed quickly and for FREE . However, you can add the following parameters:

 session.cookie_secure=True session.cookie_httponly=True session.use_cookies=True session.use_only_cookies=True
+10
source share

More articles:


All Articles