Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:29884
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 66.249.92.175 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:user-agent:mime-version:to:cc:subject:references:in-reply-to:content-type:content-transfer-encoding;
        b=VVffLBQDRATPJjGUo4GCODI4ng3fnvmVdsvuY9AXKT8D5zCXxRLPTpL13Xx3JoXZv5KwToJK7viJPWNi82mx/1kjl9G1SFdvUfeP6MYtk9RNDgESL677g7GI1OqGy81OR0kEACqbtD5BMckWtylXvVSKYouRfZMTK8qPuC0gT/A=
Message-ID: <465C7E2C.4030601@gmail.com>
Date: Tue, 29 May 2007 20:25:32 +0100
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
To: Rasmus Lerdorf <rasmus@lerdorf.com>
CC: Robert Cummings <robert@interjinn.com>,  internals@lists.php.net
References: <465C5D1D.7040206@gmail.com>  <465C6002.5080209@lerdorf.com>	 <1180462052.6874.204.camel@blobule>  <465C6D83.5000000@lerdorf.com> <1180463687.6874.210.camel@blobule> <465C7C99.4000707@lerdorf.com>
In-Reply-To: <465C7C99.4000707@lerdorf.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Session security
From: stuttle@gmail.com (Stut)

Rasmus Lerdorf wrote:
> You really want a separate and distinct signed authentication cookie
> that has nothing to do with the session.  The stored session should
> indicate which logged in user the session belongs to, but it should
> never ever be used as the sole authentication cookie.  That's what I
> meant by a separate authentication layer.

Thanks to everyone for their responses.

The issue is not about how a user is initially validated, it's about how 
you prevent the session ID from being used on a different machine while 
it's still active on the server. AFAICT using a signed authentication 
cookie will not do this since it's still coming from the client and can 
therefore be copied.

The basic question is... is there any way to validate that a session ID 
coming from the client is coming from the same client?

I don't believe there is since, as Xing pointed out, anything that comes 
from the client can a) be faked, and b) may change from request to 
request. This includes the user agent and IP address.

However, I'd like clarification on that just in case there's a reliable 
way to make sessions more secure. Oh, and also to validate the argument 
I'm making on PHP-General, but that's really a secondary goal ;)

Cheers.

-Stut