# Patch to minimize session fixation (continued)

- Thread: https://externals.io/message/8987
- Original archive: https://news-web.php.net/php.internals/8987
- Started by inodes on 2004-04-08T08:09:38+00:00
- Messages: 2
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #8987 — inodes — 2004-04-08T08:09:38+00:00

URL: https://externals.io/message/8987#8987

It is obvious my proposal is considered as a very bad idea to most of view
;-)

But my goal is not to ask for a definitive patch for PHP, so I probably made
a mistake by posting the initial message in this mailing list...

I just offer this patch for admins who manage applications developped by
others (subcontractors for example).

There are plenty of badly coded PHP apps and nodoby has time to fix them, so
if administrators want to minimize security risks, they can:

1-audit & rewrite the code
2-strengthen the underlying engine (aka PHP)

My patch is just a simple way to reenforce the security without changing any
line of code. Of course, there is a risk of loosing sessions if legitimate
users have their IP address dynamically changed. And of course, IP address
checking does not protect users behind a proxy or a NAT gateway, against
their "colleagues".

But sometimes, the IP checking can be sufficient and won't produce any
side-effect. Let the admins try and decide if it fits their apps.

Furthermore, I added other controls based on the HTTP headers sent by the
browser (this also reduces the risk of session fixation), and the IP address
test can take the IP classes (A,B and C) in account.

Official patches or changes required by users (like me) *must* perfectly
solve a problem,
and this patch is far from perfect, so...

Jerome

---

## #9021 — Andi Gutmans — 2004-04-09T07:42:16+00:00

URL: https://externals.io/message/8987#9021 · In reply to: #8987

As it won't be accepted into the main tree, if it were possible to write 
your patch as a self-contained PHP extension, then you could develop it in 
PECL. I haven't taken a look at the code to see if that's possible.
Andi

At 10:09 AM 4/8/2004 +0200, inodes wrote:
>It is obvious my proposal is considered as a very bad idea to most of view
>;-)
>
>But my goal is not to ask for a definitive patch for PHP, so I probably made
>a mistake by posting the initial message in this mailing list...
>
>I just offer this patch for admins who manage applications developped by
>others (subcontractors for example).
>
>There are plenty of badly coded PHP apps and nodoby has time to fix them, so
>if administrators want to minimize security risks, they can:
>
>1-audit & rewrite the code
>2-strengthen the underlying engine (aka PHP)
>
>My patch is just a simple way to reenforce the security without changing any
>line of code. Of course, there is a risk of loosing sessions if legitimate
>users have their IP address dynamically changed. And of course, IP address
>checking does not protect users behind a proxy or a NAT gateway, against
>their "colleagues".
>
>But sometimes, the IP checking can be sufficient and won't produce any
>side-effect. Let the admins try and decide if it fits their apps.
>
>Furthermore, I added other controls based on the HTTP headers sent by the
>browser (this also reduces the risk of session fixation), and the IP address
>test can take the IP classes (A,B and C) in account.
>
>Official patches or changes required by users (like me) *must* perfectly
>solve a problem,
>and this patch is far from perfect, so...
>
>Jerome