Re: Stopping stolen / spoofed / linked sessions

Hi When you start a session for the first time store remote host info and validate it on subsequent accesses. Tom At 10:48 PM 28/06/01, teo@gecadsoftware.com wrote:

Hi adam! On Wed, 27 Jun 2001, adam (dahamsta) wrote: [Please copy replies off-list.] I want to use PHP4 sessions for authentication, but I'm having difficulty understanding how to get around users spoofing, stealing or linking sessions. Here's an example: Alice sends Bob a link from a site she's logged into. Alice has cookies turned off in her browser, so the session id will be in the URL she sends Bob. Eve intercepts the message, follows the link and now she can take over Alice's session, and any data that is associated with that session. For that matter, Bob can do the same thing. I can think of lots of ways around this, but most of them are kludges that don't really cut it. I can store a second authentication value in a cookie, but that would require cookies, which isn't acceptable. I could propogate a second authentication variable in the URL, but that's a lot of hassle and defeats the purpose of PHP sessions. I can check the HTTP_REFERER to see if the user came from my own site, but that can be spoofed. I can log and check the users IP address, but that can't be relied upon. Is there any reliable way around this? Am I missing something obvious? there was a long and interesting thread on bugtraq @ securityfocus.com recently regarding this (it started w/ uploading images, I don't recall what was the subject, but you can figure some keywords to search for ;) Among proposed solutions was to send a ticket and validate it for each operation. Worth a search&read if you're a web developer. -- teodor -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net For additional commands, e-mail: php-general-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net