session authentication

[apm]

i am implementing my own session program. ALthough it works fine i just hav a few questions regarding security ..

I know it would be a problem if the user has a SID and then sends it to a friend who then will try to use the same SID. WHich could pose a serious risk as the sessions var for user 1 will be availble to user 2 if the sid is not yet timed out. The best solution out htere was the ip adress solution. But i had a few doubts whici i wanted to get clarified.

Use ip address. From what i have heard the ip solution is the best unless[nbsp][nbsp]its from a proxy server which would mean that the ip address would keep changing with every call.

I was on the irc chat and some one told me this is not the case with proxy servers the ip address remains the same only the port keeps changing with every call. If this is the case then what is the information that ishould store in the sessvar so that the sid can be validated. SHould i store the ip and port or should i only store the ip addrs.

1) which of the above is true for proxy's the ip changes or only the port changes with every call the user makes.

2) If you connect htorugh a proxy will each user on the proxy have a diffrent ip addrs?

3) If not how would i go about solving the problem of validating SID with the user if a user is using the proxy server to connect. As in how would i prevent 2 users from having the same SID (incase one does a cut and paste from another) conencting thorugh the same proxy server. I guess i am looking for a little bit of logic "diagram".

I hope i am clear enuf in what i am lookign ofr. If you guys need some clarification just email me or post. I iwll be glad to help you help me out :)

thanks in advance
apoorva

[Charles Capps]

You've raised good points..

A possible solution may be to use a cookie to track the user...[nbsp][nbsp]That way even if two users are using the same user ID, they could still be seperated by looking at the cookie.[nbsp][nbsp]You wouldn't need to use IP addresses for that either (thought it would be wise to, just in case).[nbsp][nbsp]Of course, then you have another whole can of worms to deal with - users who flat out reject cookies.[nbsp][nbsp]:)

[Justin]

The IP method might not be the best solution - suppose someone is going through the site and their ISP bumps them... They re-dial and voila - the site doesn't know who they are or where they've been...

I'm behind a proxy, and the REMOTE_ADDR variable is the proxy's IP, not mine - I found mine in HTTP_CLIENT_IP, though I don't know if all proxies set this variable or not...

I would go with Charles and say use a cookie storing the session ID rather than on the URL - this way they could leave the site, come back, and it still knows who they are (providing they didn't close the browser or the cookie has not expired).

Hope this helps.

------------------
Justin Nelson
FutureQuest Support

[heath]

Have you looked at phplib?

You are re-inventing the wheel, and its already been announced the functionality of phplib is what the session support in php 4.0 is based on.

I can't imagine that there is a need one would have when it comes to sessions that's not handled with phplib.

Heath

[Terra]

Here is a link that I stumbled on a couple days ago while researching MySQL HA clustering techniques...

http://prometheus.zerodivide.net/api/

The link goes to the Prometheus Project API that has a multitude of functionality, including session management...

Not sure how it stacks up against PHPlib, but at times having differing code sets allows one to re-invent the wheel using the best techniques of many...

--
Terra
--I see the wheel as nothing more than an infinite set of tangents--
FutureQuest