Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:29896
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain lerdorf.com from 204.11.219.139 cause and error)
Message-ID: <465C8A96.4020001@lerdorf.com>
Date: Tue, 29 May 2007 13:18:30 -0700
User-Agent: Thunderbird 2.0.0.0 (Macintosh/20070326)
MIME-Version: 1.0
To: Stut <stuttle@gmail.com>
CC: Stanislav Malyshev <stas@zend.com>, internals@lists.php.net
References: <465C5D1D.7040206@gmail.com>  <465C6002.5080209@lerdorf.com>	 <1180462052.6874.204.camel@blobule>  <465C6D83.5000000@lerdorf.com> <1180463687.6874.210.camel@blobule> <465C7C99.4000707@lerdorf.com> <465C7E2C.4030601@gmail.com> <465C7F1E.3010605@zend.com> <465C850D.9070807@lerdorf.com> <465C8641.5040507@zend.com> <465C87E0.8040602@lerdorf.com> <465C88DC.8030704@gmail.com>
In-Reply-To: <465C88DC.8030704@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Session security
From: rasmus@lerdorf.com (Rasmus Lerdorf)

Stut wrote:
> Rasmus Lerdorf wrote:
>> Stanislav Malyshev wrote:
>>>> The session store is just a session store.  It is not a
>>>> login/authentication mechanism and thus doesn't have any of the
>>>> protections you might want to add to that.  Therefore a separate
>>>> authentication cookie is needed that can separate the two concepts
>>> I don't see how it's "therefore". Yes, session is just a storage. But
>>> how you derive from it that authentication information can not be stored
>>> in this storage and how the separate cookie is helping you in any way
>>> make it more secure?
>>
>> Because you don't have full control over the session cookie since it is
>> generated by PHP.  For an authentication cookie you want to layer other
>> application-specific checks on top of it.
> 
> I'm still unclear on how you validate that the authentication cookie
> came from the same client machine as the one the application first sent
> it to, which was the core of my question.
> 
> The answer seems to be that you can't do it reliably.

Correct, which is why it needs to be up to the application.  You may
deem it appropriate to do it based on ip because your user base aren't
likely to be coming from AOL or other dynamic connections, or you may
find it useful to tie it to the user agent, or some other mechanism
entirely.  Like an RSA token plugin thing, for example.  But at the
general level that can't really be hardcoded into PHP since the right
answer will be different for everyone.

-Rasmus