Bug #2021

Session fixation attack vulnerability

Details

Request #2021	Session fixation attack vulnerability
Submitted	2004-07-30 08:29 UTC
From	cizek at webland dot cz
Status	Closed
Package	Auth
PHP Version	Irrelevant
OS	All
Roadmaps	(Not assigned)

Comments

[2004-07-30 08:29 UTC] cizek at webland dot cz

Description:
------------
On successful authentication using supplied username and password, the session id should be changed. It would be nice to add an object option to allow setting this behavior.
For now, I solve this by overriding the setAuth() method (see "reproduce code"), but there may be more appropriate place to put the code.
Auth Version: 1.2.3, 1.3.0r1

Reproduce code:
---------------
function setAuth($username)
{
if (session_id()) {
$_SESSION = array();
session_destroy();
}
session_id(md5(microtime().getmypid()));
session_start();

parent::setAuth($username);
}

[2006-10-30 13:57 UTC] alexiadeath at hot dot ee

session_regenerate_id(true); is not good!Ive been trying now for a day to use Auth in a framework(p4a) that heavily relies on and independently manages sessions and this behavioure completely breaks this use. For now Ive resorted to overloading this function without SID regeneration, but I really believe this should be a configurable option!

[2006-11-27 09:13 UTC] soenke dot ruempler at northclick dot de

Another problem occures if the old session cannot be destroyed:

Warning: session_regenerate_id(): Session object destruction failed in [...]/pear/Auth.php on line 712