Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69331
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.41 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXbh6dOf41nZ0r-RuRtkCuuiA=r=SnxS+A1+GgqFXPGOWQ@mail.gmail.com>
References: <CAGa2bXbh6dOf41nZ0r-RuRtkCuuiA=r=SnxS+A1+GgqFXPGOWQ@mail.gmail.com>
Date: Tue, 24 Sep 2013 22:16:54 -0700
Message-ID: <CALrkBjZNgkiSzXU86RKrLOBwKx1bQhT9oKmYiR324MGWOYWj=g@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e0102fe6e8de0dc04e72e5cc2
Subject: Re: [PHP-DEV] Regenerating session ID automatically when IP address
 has changed
From: pencap@gmail.com (Mike Willbanks)

--089e0102fe6e8de0dc04e72e5cc2
Content-Type: text/plain; charset=UTF-8

On Mon, Sep 23, 2013 at 7:29 PM, Yasuo Ohgaki wrote:

> Hi all,
>
> There isn't any good counter measure session hijack.
> However, we can regenerate session ID if IP address has changed.
> Hijacked users might notice that they have been logged out if session
> ID is regenerated by attackers. Therefore, users have slight chance
> to notice that they were under attack. It's not greatly effective, but
> better than nothing.
>
> Although this can be implemented in user script, it would be better if
> session module supports this behavior. Better security by default
> is good thing. It requires INI, since some apps may assume session
> ID would not change.
> (I do not encourage to use session ID for CSRF protection, but
> there are such implementations, for example.)
>
> A concern is that there are growing number of browsers share
> state. I do not research these browsers behavior yet. I suppose
> session cookie (expire=0) would not be shared.
>
> Anyone has any comments on this?
>

Each and every type of prevention measure has consequences and not only
that but MAJOR consequences.  If you are detecting IP changes you rule out
most if not all major proxy networks that exist.  While not first of mind;
when handling this you can easily remove the old session without properly
transitioning to the new.  This is an option based off of individual
application vs. a language option or construct.  There are a ton of
different measures that you might take based off of changes to the end user
data.  I think this would be a poor idea in the long run due to the
consequences that you may incur.

--089e0102fe6e8de0dc04e72e5cc2--