PHPSession insurance-php Tutorial

PHPSession security is recorded in stackoverflow for phpSession security discussions. (Stackoverflow. comquestions328php-session-security) 1. use SSL2. reset session_id reference PHP can: session_regenerate_id (true PHP Session Security
This is a special record of the discussion on php Session Security in stackoverflow. Http://stackoverflow.com/questions/328/php-session-security)


1. use SSL


2. reset session_id

Reference

In PHP, you can: session_regenerate_id (true );

3. set the session validity period

Can refer to the bird brother article: http://www.laruence.com/2012/01/10/2469.html


4. not a global variable


5. store information on the server and do not send important information to cookies.


6. check the user_agent and IP address of the user.

Reference

PHP Usage: if ($ _ SESSION ['User _ agent']! = $ _ SERVER ['http _ USER_AGENT ']

| $ _ SESSION ['User _ IP']! = $ _ SERVER ['remote _ ADDR ']) {

// Something fishy is going on here?

}

7. set httpOnly to avoid Session Attacks

Reference: http://ilia.ws/archives/121-httpOnly-cookie-flag-support-in-PHP-5.2.html


8. Lock down access to the sessions on the file system or use custom session handling

Reference

However, the custom session session_set_save_handler ()
Store sessions in DB and memcached

9. For sensitive operations consider requiring logged in users to provide their authenication details again