# Patch to minimize session fixation (continued)

- Thread: https://externals.io/message/8962
- Original archive: https://news-web.php.net/php.internals/8962
- Started by inodes on 2004-04-07T14:50:30+00:00
- Messages: 6
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #8962 — inodes — 2004-04-07T14:50:30+00:00

URL: https://externals.io/message/8962#8962

I agree with all your arguments: the IP-base solution IS NOT perfect.

It is not generic enough to be implemented in world-wide application, but it
can be useuful for intranet or extranets. That's to say cases when you know
the infrastructure used by the clients to connect to your server support
this strategy.

My goal is to minimize the risks for now, since I don't know yet what the
perfect solution could be.

Other tests could be made:
- on the browser headers
- on IP ranges rather that on the single client IP address
- and so on...

Jerome

---

## #8964 — Sascha Schumann — 2004-04-07T15:03:46+00:00

URL: https://externals.io/message/8962#8964 · In reply to: #8962

> It is not generic enough to be implemented in world-wide application, but it
> can be useuful for intranet or extranets. That's to say cases when you know
> the infrastructure used by the clients to connect to your server support
> this strategy.

    If you want this feature, implement it in your PHP script.

    - Sascha

---

## #8966 — Sean Coates — 2004-04-07T16:08:22+00:00

URL: https://externals.io/message/8962#8966 · In reply to: #8962

While I like that your patch can be turned on and off in the INI, this 
sounds much more like an application-level problem, and thus should be 
implemented at the application level.

MHO.

S

inodes wrote:
> I agree with all your arguments: the IP-base solution IS NOT perfect.
> 
> It is not generic enough to be implemented in world-wide application, but it
> can be useuful for intranet or extranets. That's to say cases when you know
> the infrastructure used by the clients to connect to your server support
> this strategy.
> 
> My goal is to minimize the risks for now, since I don't know yet what the
> perfect solution could be.
> 
> Other tests could be made:
> - on the browser headers
> - on IP ranges rather that on the single client IP address
> - and so on...
> 
> Jerome

---

## #8967 — Hans Lellelid — 2004-04-07T16:50:52+00:00

URL: https://externals.io/message/8962#8967 · In reply to: #8962

I also would add that from experience using IP addresses to validate 
sessions does not work for any internet application.

> It is not generic enough to be implemented in world-wide application, but it
> can be useuful for intranet or extranets. That's to say cases when you know
> the infrastructure used by the clients to connect to your server support
> this strategy.

Yes, I suppose this is true, but if you are building an intranet 
application you probably aren't going to need this additional security.

I agree with the others -- this belongs in your application.  In 
particular to prevent session fixation (rather than session hijacking) 
use the `session_regenerate_id()` after authentication happens.  This 
should prevent fixation.

Hans

---

## #8976 — Jochem Maas — 2004-04-08T01:48:51+00:00

URL: https://externals.io/message/8962#8976 · In reply to: #8966

Sean Coates wrote:

> While I like that your patch can be turned on and off in the INI, this 
> sounds much more like an application-level problem, and thus should be 
> implemented at the application level.

Loads of people have actually put stuff out that does this...
	^
	|
> > […]

What about a scoring system (based on checks on the above and more?),
a bit like that which is used in products like spamAssassin, the ini 
setting could be a threshold value (0 basically meaning attempt no 
checks and any value > 0 && =< 1 to be reject/accept* threshold).

...anyway the idea of being able to do some kind of sanity check on 
behalf 'beginners' (no offensive intended) is a nice idea. Advanced 
users tend to have specific environment requirements (and set them up 
accordingly) and perform decent checking anyway.

---

## #8977 — George Schlossnagle — 2004-04-08T01:57:46+00:00

URL: https://externals.io/message/8962#8977 · In reply to: #8976

> Sean Coates wrote:
>
> > […]
>
> Loads of people have actually put stuff out that does this...
> 	^
> 	|
> > […]
>
> What about a scoring system (based on checks on the above and more?),
> a bit like that which is used in products like spamAssassin, the ini 
> setting could be a threshold value (0 basically meaning attempt no 
> checks and any value > 0 && =< 1 to be reject/accept* threshold).
>
> ...anyway the idea of being able to do some kind of sanity check on 
> behalf 'beginners' (no offensive intended) is a nice idea. Advanced 
> users tend to have specific environment requirements (and set them up 
> accordingly) and perform decent checking anyway.

All of the above methods have problems with proxy servers.  As a robust 
solution to the problem doesn't exist, people should implement their 
own non-robust solutions in their own scripts.

George