# Patch to minimize Session Fixation Risks

- Thread: https://externals.io/message/8959
- Original archive: https://news-web.php.net/php.internals/8959
- Started by inodes on 2004-04-07T13:56:45+00:00
- Messages: 4
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #8959 — inodes — 2004-04-07T13:56:45+00:00

URL: https://externals.io/message/8959#8959

Hello,

The PHP manual says it is the developer's job to ensure PHP sessions cannot
be stolen or "fixed" (this is called Session Fixation).

To minimise the risk of session fixation, I wrote a patch for PHP-4.3.5 (I
can port it for the other versions too - just ask...), that makes (almost)
sure the current user IS the session creator. It is based on client IP
addresses.

This patch is available at: http://www.trickytools.com/php/sesfixpatch.php

If you think this could be useful, it could be improved and someday be part
of the official distro.

Jerome Delamarche

---

## #8961 — Robert Cummings — 2004-04-07T14:17:14+00:00

URL: https://externals.io/message/8959#8961 · In reply to: #8959

> Hello,
> 
> The PHP manual says it is the developer's job to ensure PHP sessions cannot
> be stolen or "fixed" (this is called Session Fixation).
> 
> To minimise the risk of session fixation, I wrote a patch for PHP-4.3.5 (I
> can port it for the other versions too - just ask...), that makes (almost)
> sure the current user IS the session creator. It is based on client IP
> addresses.
> 
> This patch is available at: http://www.trickytools.com/php/sesfixpatch.php
> 
> If you think this could be useful, it could be improved and someday be part
> of the official distro.

I remember reading in the forums before that using the request IP to
"fixate" a session isn't practical since some ISPs (namely AOL) can have
the request IP suddenly change between one request and another.

Cheers,
Rob.
-- 
.------------------------------------------------------------.
| InterJinn Application Framework - http://www.interjinn.com |
:------------------------------------------------------------:
| An application and templating framework for PHP. Boasting  |
| a powerful, scalable system for accessing system services  |
| such as forms, properties, sessions, and caches. InterJinn |
| also provides an extremely flexible architecture for       |
| creating re-usable components quickly and easily.          |
`------------------------------------------------------------'

---

## #8960 — Stefan Esser — 2004-04-07T14:20:32+00:00

URL: https://externals.io/message/8959#8960 · In reply to: #8959

Hello,

>sure the current user IS the session creator. It is based on client IP
>addresses.
>  
>
A legal user can have multiple IP addresses at the same time. This can 
have several reasons...

for example
a) ISP did disconnect him inbetween clicks
b) he is using a proxy but for the https part of your site he has no proxy
c) he or is proxy is using a NAT gateway

Stefan Esser

---

## #8963 — George Schlossnagle — 2004-04-07T15:03:06+00:00

URL: https://externals.io/message/8959#8963 · In reply to: #8961

> 
> > […]
>
> I remember reading in the forums before that using the request IP to
> "fixate" a session isn't practical since some ISPs (namely AOL) can 
> have
> the request IP suddenly change between one request and another.

Yes, this behavior is quite common for many of the large ISPs.

George