Re: Session IP address matching

Am 25.01.14 04:15, schrieb Andrey Andreev: > On Sat, Jan 25, 2014 at 4:21 AM, Andrea Faulds <ajf@ajf.me> wrote: >> >> >> On 25/01/14 01:11, Andrey Andreev wrote: >>> >>> Yes, one can write a custom session handler, but there's a number of >>> problems with that: >> >> >> Correct me if I'm wrong, but why would you need to do that? Surely, this >> would suffice: >> >> if (!isset($_SESSION['ip'])) { >> $_SESSION['ip'] = $_SERVER['REMOTE_ADDR']; >> } else if ($_SERVER['REMOTE_ADDR'] !== $_SESSION['ip']) { >> session_destroy(); >> } >> > > - I don't want the IP stored in session data, I already know it. > - filemtime() result of the potentially targeted session id is > changed, extending its expiry time > - multiple set-cookie headers > > Basically, I want it to be perfect. :) > Hi all. Don't bash me when I'm wrong, but why would you want the IP check for the session in the first place? Don't get me wrong, I'm definitely in favour of more security, but the issue I see, is the following: When a user has an ISP that regularrily changes the IP-address assigned to the user via DHCP the session then is lost, isn't it? So suddenly the user is logged of without any apparent reason whatsoever. And if that's not a problem, please take into account the users real address and not the address of any proxy that is in between (at least when it's possible to determin it). And that involves a lot of header checks, whether one or the other is set. And as soon as the appropriate header is not set (which might be the case due to proxy misbehaviour or misconfiguration), you will "only" have the IP of the Proxy. So all users behind such a proxy will share the same IP-address. The same goes for users behind NAT in a private network. So there might be so many exceptions that I wouldn't know whether it'a security benefit or not. Or am I completely wrong and didn't get the point? Then feel free to simply ignore this mail. Andreas -- ,,, (o o) +---------------------------------------------------------ooO-(_)-Ooo-+ | Andreas Heigl | | mailto:andreas@heigl.org N 50°22'59.5" E 08°23'58" | | http://andreas.heigl.org http://hei.gl/wiFKy7 | +---------------------------------------------------------------------+ | http://hei.gl/root-ca | +---------------------------------------------------------------------+

Attachment: [application/pkcs7-signature] S/MIME Cryptographic Signature smime.p7s