note 66331 deleted from function.setcookie by bjori
| From: | bjori@php.net | Date: | Mon, 08 Jan 2007 10:50:26 +0000 |
| Subject: | note 66331 deleted from function.setcookie by bjori | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-121434@lists.php.net to get a copy of this message | ||
Note Submitter: Ahmet Antmen ahmetantmen_at_msn_dot_com
----
You can be sure about the cookie files contents weren't changed.
<?php
$Seperator = '--';
$uniqueID = 'Ju?hG&F0yh9?=/6*GVfd-d8u6f86hp';
$Data = 'Ahmet '.md5('123456789');
setcookie('VerifyUser', $Data.$Seperator.md5($Data.$uniqueID));
if ($_COOKIE) {
$Cut = explode($Seperator, $_COOKIE['VerifyUser']);
if (md5($Cut[0].$uniqueID) === $Cut[1]) {
$_COOKIE['VerifyUser'] = $Cut[0];
} else {
die('Cookie data is invalid!!!');
}
}
echo $_COOKIE['VerifyUser'];
?>
Create a unique id for your site and create a hash with md5($Data.$uniqueID). Attacker can
understant that it must be re-hash after change cookie content.
But doesn't. Because cannot guess your unique id. Seperate your hash and data with seperator
and send that cookie. Control that hash of returned value and your unique id's is same returned
hash. Otherwise you have to stop attack. Sorry for my poor english!