Home » Authentication » LiveUser » Bug #1845

[2004-07-11 17:31 UTC] roehr at zilleon dot com

Description:
------------
Hi,

I would like to see a feature added to provide additional security and hamper session hijacking.

An additional check in isLoggedIn() should be made optionally available to check for certain $_SERVER values to better verify if the user accessing the site is the one who originally logged in.

It should be possible to supply the key names of the $_SERVER array that should be checked:

$LUconfig = array(//...
'server_values' => array('HTTP_USER_AGENT', 'ROMETE_ADDR')
//...
);

When the user logs in and the login was successful the specified values from $_SERVER are stored as an associative array in a new LiveUser_Auth_Common property called server_values.

var $server_values = array(
'HTTP_USER_AGENT' => 'Opera/7.23',
'ROMETE_ADDR' => '127.0.0.1'
);

Then whenever isLoggedIn() is called and the property contains at least one key/value pair the stored value(s) is/are compared to the current value(s) from $_SERVER. If all stored values are equal to the current values and loggedIn is true as well then true is returned from isLoggedIn().

If you feel this would be a valuable feature I would be glad to contribute the required code changes.

Thanks in advance for having a look.

Best regards,
Torsten Roehr

[2004-10-08 13:48 UTC] ms at oscag dot de

Hi,

in some cases ISP´s change the IP´s dynamicly in one user-session. So the check of 'REMOTE_ADDR' would fall.

Best regards
Michael Strehlau

[2004-10-08 14:14 UTC] roehr at zilleon dot com

Thanks, Michael. I know about this. But there are other values in $_SERVER that might be used to check for the user's identity. I would appreciate if LiveUser would provide a(n optional) way to check the values of user-specified keys in $_SERVER - if people take advantage of this is another case.

Regards, Torsten

[2004-10-11 11:16 UTC] smith at backendmedia dot com

Well I have a client that also wanted an IP based check. I simply extended the MDB2 container and added the feature. All I had todo was overwrite the _readUserData() method with my additional IP checks.

[2004-10-20 09:47 UTC] roehr at zilleon dot com

Thanks for your suggestion, Lukas. But what I have in mind is different to only allowing certain IPs:

When the user (successfully) logs in the values of the specified keys from $_SERVER are stored in the Auth object (e.g. the browser ident string). Then whenever the user is accessing a protected page isLoggedIn() checks if the stored values are identical to the current $_SERVER values (e.g. if the browser used is still the same).

This would be an additional burden for session hijacking. Which values from $_SERVER should be verified on each page request would be defined in the LU config array.

It would be purely optional - if you don't define any $_SERVER keys in config they won't be checked by isLoggedIn().

I really would like to see this feature added and would happily contribute the required changes to the LiveUser and Auth classes. What do you think?

Regards, Torsten

[2004-12-08 18:08 UTC] smith at backendmedia dot com

So these additional checks would need to happen inside LiveUser::unfreeze(). I guess the best option would be to allow the unfreeze() method to return a boolean to denote if unfreeze() was able to recognize the user and restore the session data. Recognize would mean running the checks that you mentioned. In that case you would then extend the auth container while redefining the unfreeze() method (and what ever else you may choose).

Is that about it?

[2004-12-08 20:00 UTC] smith at backendmedia dot com

This bug has been fixed in CVS.

In case this was a documentation problem, the fix will show up at the
end of next Sunday (CET) on pear.php.net.

In case this was a pear.php.net website problem, the change will show
up on the website in short time.

Thank you for the report, and for helping us make PEAR better.

LiveUser now expexts a boolean value from the auth container unfreeze() method in order to accept the values from the unfreeze() method as a valid login. You can now extend the auth container and replace the unfreeze() implementation as you see fit.