$ _SESSION ['loggedin']，特定用户的标识和安全性问题

Question

Please, advice if my thoughts are correct. I have searched for information but have not found exact answer.

User enters username and password and the entered username/password are the same as in mysql.

I create $_SESSION['loggedin'] = 1; This means that somewhere on server is created file with random name like r21bj2a3.... and in user browser is created cookie with value like r21bj2a3....

On next page I check if( $_SESSION['loggedin'] == 1 ). User browser connect to server, send to server information like: I have cookie with value r21bj2a3...., please send me content of ? session? Server sends information that for the particular cookie session loggedin is 1.

As I understand if malicious user gets cookie value r21bj2a3...., sends to server and gets the same answer as normal user?

Depending on $_SESSION['loggedin'] I can not identify particular user? To identify particular user after successful login I can create unique token, record in mysql and pass with session? And on password protected page from the passed session I get token value and check (select) if such value exists in mysql. Is this way ok? May be post some link with good method?

Regarding token. I pass the token value with sessions. That means if malicious user get cookie value, send to server and get answer, containing token value (so malicious user gets rights of normal user)?

Answer 1

To identify which user the session belongs to, just set a viable in the session

$_SESSION['user'] = user

You are correct about the cookie giving access to the session. If security is important, use SsL.

Answer 2

HTTP is stateless protocol.It does not keep track of data across several pages.So we require session which can be globally accessible across all pages in website

For identifying the user who is currently logged into website we need to store value of user_id field in user table into session after he is authenticated successfully.

eg

$_SESSION['user_id']=$result['user_id']

And to determine whether user is logged in or not we can check the value of $_SESSION['user_id'] variable .If it is empty then user is not logged in else user is logged in

Answer 3

I suggest to save all active sessions in the database, you can create a table for doing that, to prevent session hijacking, you can check each particular session (login) and see if user already authenticated, then, do not allow second authentication.

The problem here, how to recognize user? You can bind some Information like USER_AGENT, and IP Address, however, these information can also be spoofed by hacker, but, the probability is less.

Also, once user signed out, you can delete the session record in the database.