Home > Article > Backend Development > Is it safe to use session in php?

Is it safe to use session in php?

怪我咯Original: 2017-07-05 09:44:491437browse

Is session safe in PHP? PHP only provides us with a session implementation. Subsequent security work requires programmers to master it flexibly. Therefore, PHP programming is really flexible. Friends who need to understand session security in PHP can refer to

I have been developing PHP for so long, and I have never really paid attention to security issues. I always focus on completing the project. I recently saw an article about security on the Internet. After reading it, I noticed that it existed in my previous projects. There was a big security hole, so I picked a project and tested it, and found that it was easy to get caught. Here I will share a test example I wrote to illustrate how the session in PHP is unsafe and how to strengthen its security in the project.
Regarding the principle and mechanism of session, there are many good articles on the Internet to introduce it, we can check it by ourselves. Let’s share examples for testing directly.
The example of this test is mainly a login page. After successful login, you can change the password. It is such a simple function.
The interface is as follows

First, use the function session_start() at the project entrance to open the session. In this way, when the client initiates a request, an identity identifier, namely SessionID, will be generated. It is saved on the client through cookie. Each communication between the client and the server relies on this SessionID for identification. After successful login, the user id and user name will be stored in the session

$_SESSION[‘userid&#39;] = 用户id
$_SESSION[‘uname&#39;] = 用户名

All subsequent operations will check whether the user is logged in by judging whether $_SESSION['userid'] exists. The code is as follows:

if(isset($_SESSION[&#39;userid&#39;])) return true;

The call to the password modification interface transmits data to the server through ajax post.

$.post("接口*******",
  {
     oldpass:oldpass,
     newpass:newpass,
     userid:uid,
  },
  function(data){
     data = eval(&#39;(&#39; +data+ &#39;)&#39;);
     $(&#39;.grant_info&#39;).html(infos[data.info]).show();
  }
);

Note that I wrote this code in the html page, so if you see the html code, you will know the interface address.

The interface for changing the password is implemented in this way. First, it is judged whether the user is logged in. If the user is logged in, the password modification operation will be performed.
The implementation idea of the test example is probably as described above.

Using SessionID Attack
1. The first is to obtain the SessionID. Of course, there are many ways for attackers to obtain this ID. Due to my limited level, I will not introduce how to obtain it here. We can simulate it by first accessing this project normally, and then checking the SessionID through the browser to get a legal user ID. You can see this ID

 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: keep-alive
Cookie: Hm_lvt_bf1154ec41057869fceed66e9b3af5e7=1450428827,1450678226,1450851291,1450851486; PHPSESSID=2eiq9hcpu3ksri4r587ckt9jt7;
Host: ******
Referer: ******
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:41.0) Gecko/20100101 Firefox/41.0

in the request header. After getting the sessionID, if the

user logs in successfully, then the user's information will be in the session on the server side. 2. After obtaining the SessionID, if the attacker already knows the interface for changing the password, he can directly change the user's password. If the attacker has not yet obtained the interface address, he or she can find out the interface address by looking at the page code. You can use the following command

#curl --cookie "PHPSESSID=2eiq9hcpu3ksri4r587ckt9jt7" 页面地址

As we said above, in this example the ajax code is written in the html page, so you can view the interface address on this page

Part of the html code is as follows

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
……
var uid = $(".userid").val();
$.post("/User/User/modifypass_do",
     {
        oldpass:oldpass,
        newpass:newpass,
        userid:uid,
     },
    function(data){
      data = eval(&#39;(&#39; +data+ &#39;)&#39;);
      $(&#39;.grant_info&#39;).html(infos[data.info]).show();
    }
 );
……
<span><input type="password" name="oldpass" id="textfield_o" placeholder="原密码"></span>
<span><input type="password" name="newpass" id="textfield_n" placeholder="新密码"></span>
<span><input type="password" name="confirmpass" id="textfield_c" placeholder="确认密码"></span>
<input type="button" class="btn_ok" value="确认修改" />

3. After getting the interface, you can send data through curl to simulate post to change the password.

The command is as follows

# curl --cookie "PHPSESSID=2eiq9hcpu3ksri4r587ckt9jt7" -d oldpass=111111 -d newpass=000000 -d userid=用户id 接口地址

If the user is already logged in, the attacker can change the user's password by executing the above command.

Solution
For the above attacks, we can enhance its security by complicating the verification method. One of the ways is to use the User-Agent item in the request header to enhance its security

 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: keep-alive
Cookie: Hm_lvt_bf1154ec41057869fceed66e9b3af5e7=1450428827,1450678226,1450851291,1450851486; PHPSESSID=2eiq9hcpu3ksri4r587ckt9jt7;
Host: ******
Referer: ******
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:41.0) Gecko/20100101 Firefox/41.0

At the beginning of the project, we just used the session_start() function to open the session. Now we can add this code

$_SESSION[‘User_Agent&#39;] = md5($_SERVER[‘HTTP_USER_AGENT&#39;]);

below session_start() and then add the following judgment conditions every time to determine whether to log in

If(isset($_SESSION[‘userid&#39;]) && $_SESSION[‘User_Agent&#39;] == md5($_SERVER[‘HTTP_USER_AGENT&#39;])){
    return true;
}

This way we can avoid the above simple attack.

Summary:
Of course, the actual attack is far from simple. First, it is more difficult to obtain the SessionID. Then, the code interacting with the server must be encrypted as much as possible to avoid the above situation. After we modify the code for the second time, we can increase the complexity of the attack, but it cannot eliminate the attack. There are many ways to attack. This is just a simple way and only provides an idea, but the principle is the same. In actual situations, the security of our code can be enhanced according to the actual situation.

Here I just share the problems I encountered at work, and I hope everyone can learn more in depth.

The above is the detailed content of Is it safe to use session in php?. For more information, please follow other related articles on the PHP Chinese website!

Statement：

The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Previous article：Do you know the security issues of php session?Next article：Do you know the security issues of php session?

See more

Is it safe to use session in php?

Related articles