Re: [PHP] Session Authentication

On 4/9/07, Martin Marques <martin@xxxxxxxxxxxxxxx> wrote:
Ólafur Waage escribió:
> Lets say i have a login system. This system authenticates the user via
> mysql, when the user is authenticated, i set a session variable to let the
> system know the user is authenticated. ie. $_SESSION["authenticated"] =
> true;
>
> Lets also say i know that's how the system works, that a session variable
> within my browser is set to true. Could i do this if i knew all this info
> and "authenticate" myself by setting the variable from the client side?

The only way I know is, if you use transid (transparent session id), the
cracker could hijack your session id and the system would think that
it's you (suppose that it's your session that got hijacked)

> If it is possible, what can i do to prevent this or increase security?

Yes:

Don't use transparent session id, or even better, save the
authentication in a cookie on the client (seperated from the session array).

And then the user would crack the cookie ....
I know they are encrypted, but trust me, cookies can be edited.

Tijnema
.

Relevant Pages

  • Re: IIS6 - Can session id be manipulated?
    ... I've got a very persistent customer who claims, ... hijack another session by changing the session id in your own session ... hiding other possibly identifiable information to tie the cookie to. ...
    (microsoft.public.inetserver.iis.security)
  • Re: IIS6 - Can session id be manipulated?
    ... I've got a very persistent customer who claims, ... hijack another session by changing the session id in your own session ... to get the session cookie the hijacker would have to intercept the data when ...
    (microsoft.public.inetserver.iis.security)
  • nxserver failing connection: NX> 504 Session startup failed
    ... it authenticates me succesfully. ... NX> 703 Session type: unix-default ... NX> 701 Proxy cookie: 9adede47aa8d7e60301d092144e56ef3 ... I am not sure whether it is complaining about a 1 coming from somewhere, or that the 1 is simply the exit 1 variable. ...
    (freebsd-questions)
  • Re: Problems with Forms Auth and Session State.
    ... At the point my user authenticates, I set up their session variables. ... >> different cookie than the Session cookie. ... >> using Forms auth to auth the user and set the Auth cookie. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Problems with Forms Auth and Session State.
    ... >At the point my user authenticates, ... session variables. ... (I mean I know why it is two different cookies, ... >> To invalidate ASP.NET auth cookie, ...
    (microsoft.public.dotnet.framework.aspnet.security)