Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69303
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.173 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
Date: Tue, 24 Sep 2013 11:29:25 +0900
Message-ID: <CAGa2bXbh6dOf41nZ0r-RuRtkCuuiA=r=SnxS+A1+GgqFXPGOWQ@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7b343cd22481cb04e717ea19
Subject: Regenerating session ID automatically when IP address has changed
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--047d7b343cd22481cb04e717ea19
Content-Type: text/plain; charset=UTF-8

Hi all,

There isn't any good counter measure session hijack.
However, we can regenerate session ID if IP address has changed.
Hijacked users might notice that they have been logged out if session
ID is regenerated by attackers. Therefore, users have slight chance
to notice that they were under attack. It's not greatly effective, but
better than nothing.

Although this can be implemented in user script, it would be better if
session module supports this behavior. Better security by default
is good thing. It requires INI, since some apps may assume session
ID would not change.
(I do not encourage to use session ID for CSRF protection, but
there are such implementations, for example.)

A concern is that there are growing number of browsers share
state. I do not research these browsers behavior yet. I suppose
session cookie (expire=0) would not be shared.

Anyone has any comments on this?

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--047d7b343cd22481cb04e717ea19--