Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69386
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.171 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAHMUw2EQuT-y2Ho85QXhDdtysTWC=4FyY4nK9i-yR7qGqk6M=Q@mail.gmail.com>
References: <CAGa2bXbh6dOf41nZ0r-RuRtkCuuiA=r=SnxS+A1+GgqFXPGOWQ@mail.gmail.com>
	<CABBJUpdNr6McK6Q4qtztiYYG9CKZF7AeUdvo3YM+W0S87f8nDg@mail.gmail.com>
	<CAPwsocEwM_A3YraxZmJEXjBxaGgTZhfv711801bwtHLfJfNh+Q@mail.gmail.com>
	<CAHMUw2EQuT-y2Ho85QXhDdtysTWC=4FyY4nK9i-yR7qGqk6M=Q@mail.gmail.com>
Date: Fri, 27 Sep 2013 11:12:27 +0100
Message-ID: <CAPwsocGh-e1xAmvxgBF6St++9TBdW6uzRy8Xu4Jhb4p-N4vFvQ@mail.gmail.com>
To: Tjerk Meesters <tjerk.meesters@gmail.com>
Cc: PHP Internals <internals@lists.php.net>, Yasuo Ohgaki <yohgaki@ohgaki.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] Regenerating session ID automatically when IP address
 has changed
From: leight@gmail.com (Leigh)

On 26 September 2013 11:32, Tjerk Meesters <tjerk.meesters@gmail.com> wrote:
>
> On Thu, Sep 26, 2013 at 6:19 PM, Leigh <leight@gmail.com> wrote:
>>
>> There's several scenarios where a users IP changes and you don't want to
>> drop their session. (That doesn't mean it should simply have an option to
>> disable it either)
>
>
> Let's be clear here: this won't happen (in most cases), because the client
> will simply get a new cookie and the session will keep working; it's like
> what you would implement if your user level goes from anonymous to logged in
> and vice versa.

Right, so maybe I misunderstood the intent of this.

I was reading it as: valid SID on new IP = drop session, which to me
seems like the more "secure" approach.

What you're saying is is when a valid SID is supplied on a new IP, you
regenerate the SID and the session continues to be valid on the new
IP?

So on a successful session hijack (correct SID, new IP) the attacker
gets a new SID and keeps the valid session while the legitimate user
gets kicked out.

Not seeing how that improves things at all.