note 8187 deleted from ref.session by sniper
| From: | sniper@php.net | Date: | Tue, 21 Jan 2003 03:27:59 +0000 |
| Subject: | note 8187 deleted from ref.session by sniper | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-42501@lists.php.net to get a copy of this message | ||
> This means that a user can takeover the session of another user if he
> knows (or guesses) the other user's session id. (all web applications are
> vulnerable to this attack).
While it is true that you can take over other users' session ID's, there are
several things you can do to prevent this from happening.
One way is to store the remote user's IP address on the server.
When you start a new session, do this:
$ipaddr = $REMOTE_ADDR;
session_register("ipaddr");
And when the user requests a document with sensitive data
verify his/her IP address:
if($ipaddr != $REMOTE_ADDR) {
echo "Go away!\n";
exit;
}
hartmut@six.de:
WARNING: this does not work if the user
lives behind a proxy-farm as remote
address will change if different requests
are servered by different hosts in the
proxy pool