CODEWITHSUNDEEP
phpmysqlsqlsessionsession-hijacking
user870283
user870283

Reputation:

PHP Session - Multiple Users With 1 IP

On Monday, I thought I had solved the session hijacking security issue by setting the session as the user IP, until I logged in. I had two users with the same IP (myself and a test user) and it kept switching between the two. Is there a way to prevent this and allow two users with the same IP register on my site?

Thanks in advance, Terry.

Upvotes: 1

Views: 1411

Answers (3)

Platipuss
Platipuss

Reputation: 78

SSL the entire site if it is a concern and apply a short cookie time out. The ssl will encrypt the cookie and transmission so it can not be sniffed off the wire. A short time to live will make the cookie useless soon after it has been taken from the "logged in" computer if they have direct access to the system. So in short get a security cert and go on as normal with a normal php session.

Upvotes: 1

webbiedave
webbiedave

Reputation: 48887

You may have been reading advice about storing the user's IP in a table along with the session id (not in place of). You'd then check to make sure they're coming from the same IP on subsequent requests, otherwise, force them to login again. This method has problems as well a user's ip can change as often as every ten minutes depending on their ISP!

Use the session id provided by PHP as it's unique and difficult to guess. Require it to be read from a cookie and never from the URL.

Upvotes: 1

Nahydrin
Nahydrin

Reputation: 13517

I take it you're looking for the user's information in the MySQL database, using their IP? That is wrong. The only way to be truely unique is with a primary key field.

Either store the primary key as the session and pull their data, or store relevant information in the session and only pull anything else when it is needed.

Upvotes: 0

Related Questions