PHP Session Help !

[muji4832]

Guys i need some help on PHP session. Not sure if there's anything wrong with my thoughts. Consider the following scenario,

I don't want to use the standard "PHPSESSID" identifier as my session cannot be shared accross browser tabs. I believe this is the standard identifier created in a cookie by the session_start() function.

Implementation
I will use the session_name($random_8_digits)

Problem
How do i retrieve my session if I do not want to pass the "$random_8_digits" through GET / POST for security reasons ?

Does it even make sense ?

 

[natnai]

Guys i need some help on PHP session. Not sure if there's anything wrong with my thoughts. Consider the following scenario,

I don't want to use the standard "PHPSESSID" identifier as my session cannot be shared accross browser tabs. I believe this is the standard identifier created in a cookie by the session_start() function.

Implementation
I will use the session_name($random_8_digits)

Problem
How do i retrieve my session if I do not want to pass the "$random_8_digits" through GET / POST for security reasons ?

Does it even make sense ?

You can use a bearer token instead of storing the session id in a cookie. I use this now in all my projects. I'm not sure how to implement this in PHP, but I think a bit of Googling should reveal several libraries implementing web tokens. You'll need to encode/decode JSON though.

 

[natnai]

http://www.sitepoint.com/php-authorization-jwt-json-web-tokens/

The client has to send the token together with _every_ request, otherwise the server _should_ return an unauthorized response (401 or 403).

It should be noted though that this is typically implemented in REST APIs, so one would typically build a front end in a mobile application or a browser-based SPA. This allows you to store the token in local storage. Read more about that API here: http://www.w3schools.com/html/html5_webstorage.asp

Once you have implemented authorisation, if you need to store state for whatever reason, you can just retrieve sessions as you would normally in cookie-based authorisation, with whatever database tech you use (typically Redis).

 

[davidktw]

Guys i need some help on PHP session. Not sure if there's anything wrong with my thoughts. Consider the following scenario,

I don't want to use the standard "PHPSESSID" identifier as my session cannot be shared accross browser tabs. I believe this is the standard identifier created in a cookie by the session_start() function.

Implementation
I will use the session_name($random_8_digits)

Problem
How do i retrieve my session if I do not want to pass the "$random_8_digits" through GET / POST for security reasons ?

Does it even make sense ?

Cookies or URL parameters is normally how you maintain a session between client and the server.

Sessions are not obstructed by tabs or windows. When using cookies, your cookie domain is the control if it get sent to the server.

PHP normally uses cookie for session keeping, which you can configure in php.ini using "session.use_cookies"

There is normally no need to explicitly set the session name unless you have a good use case because it will serve very little purpose in most general purpose session keeping.

I failed to see any security concern with passing your session over to the client unless what you want is a token for API purpose. Security should be handled using secured connection such as HTTPS or typical SSL conduit or secure message passing technique. Passing session token as-is has no security implication when done properly between server and trusted client.

Session is just a meaningless string or number, it does not reveal any confidential information that the server do not want to send out.

 

[cwchong]

I think you are mistaken about the use of the session name.

It is like you said, to replace the standard "PHPSESSID", but it is a fixed in your script/application.
e.g. you define it as "MYOWNNAME", but it'll always be "MYOWNNAME" when your script is run, regardless of whether they are in the same browser tab or not.
You can open an icognito window and its still the same name.

The "thing" that identifies your browser tab session uniquely will likely have to be generated client-side.

Assuming that your app consist of some form posting, what I think might work would be:

1. add a hidden form input to your form/page, called TabID, and filling it with its posted value if available
<input type="hidden" name="TabID" value="<?php isset($_POST['TabID']) echo $_POST['TabID'] : ''; ?>" />

2. generate via javascript, a new GUID for the TabID field, IF it is empty (first run in a tab)
var tabIDfield = $("input[name=TabID]");
if (tabIDfield.length && tabIDfield.val() == "") {
    var guid = your_guid_algo_here();
    tabIDfield.val(guid);
}

3. on submit/post, your php handler code stores your variables nested within this TabID field so that it can be retrieved later on a per tab basis
$name = $_POST['name'];
$email = $_POST['email'];
$tabID = $_POST['TabID'];
$_SESSION[$tabID] = array(
  'name' => $name,
  'email' => $email
);

4. whenever you need to pull out info on a tab basis, make sure it is retrieved from the multi-dim array:
echo "Your tab's session email is " . $_SESSION[$tabID]['email'];

for this to work all actions in your app would have to post the guid field.

 

[natnai]

I think you are mistaken about the use of the session name.

It is like you said, to replace the standard "PHPSESSID", but it is a fixed in your script/application.
e.g. you define it as "MYOWNNAME", but it'll always be "MYOWNNAME" when your script is run, regardless of whether they are in the same browser tab or not.
You can open an icognito window and its still the same name.

The "thing" that identifies your browser tab session uniquely will likely have to be generated client-side.

Assuming that your app consist of some form posting, what I think might work would be:

1. add a hidden form input to your form/page, called TabID, and filling it with its posted value if available
<input type="hidden" name="TabID" value="<?php isset($_POST['TabID']) echo $_POST['TabID'] : ''; ?>" />

2. generate via javascript, a new GUID for the TabID field, IF it is empty (first run in a tab)
var tabIDfield = $("input[name=TabID]");
if (tabIDfield.length && tabIDfield.val() == "") {
    var guid = your_guid_algo_here();
    tabIDfield.val(guid);
}

3. on submit/post, your php handler code stores your variables nested within this TabID field so that it can be retrieved later on a per tab basis
$name = $_POST['name'];
$email = $_POST['email'];
$tabID = $_POST['TabID'];
$_SESSION[$tabID] = array(
  'name' => $name,
  'email' => $email
);

4. whenever you need to pull out info on a tab basis, make sure it is retrieved from the multi-dim array:
echo "Your tab's session email is " . $_SESSION[$tabID]['email'];

for this to work all actions in your app would have to post the guid field.

Up for elegant solution without needing to mess with JWT auth.

 

[muji4832]

wow ... this is new and chim for me ... will try it out if got chance ... right now don't wana revamp too much in my application ... Thanks !

http://www.sitepoint.com/php-authorization-jwt-json-web-tokens/

The client has to send the token together with _every_ request, otherwise the server _should_ return an unauthorized response (401 or 403).

It should be noted though that this is typically implemented in REST APIs, so one would typically build a front end in a mobile application or a browser-based SPA. This allows you to store the token in local storage. Read more about that API here: http://www.w3schools.com/html/html5_webstorage.asp

Once you have implemented authorisation, if you need to store state for whatever reason, you can just retrieve sessions as you would normally in cookie-based authorisation, with whatever database tech you use (typically Redis).

 

[muji4832]

Yah i think session_name() is not designed to use that way. My initial concern was to use some random digits to for the session id so as to prevent anyone to guess it. And now i have problem passing it through the pages without having a form to post it.

The idea below is nice and simple for session management across tabs. But right now i need to change to a constant value for the session cookie name as well as including the new tab ID in all the pages ... seems like a revamp

Also thanks to all who have contributed their valuable input

I think you are mistaken about the use of the session name.

It is like you said, to replace the standard "PHPSESSID", but it is a fixed in your script/application.
e.g. you define it as "MYOWNNAME", but it'll always be "MYOWNNAME" when your script is run, regardless of whether they are in the same browser tab or not.
You can open an icognito window and its still the same name.

The "thing" that identifies your browser tab session uniquely will likely have to be generated client-side.

Assuming that your app consist of some form posting, what I think might work would be:

1. add a hidden form input to your form/page, called TabID, and filling it with its posted value if available
<input type="hidden" name="TabID" value="<?php isset($_POST['TabID']) echo $_POST['TabID'] : ''; ?>" />

2. generate via javascript, a new GUID for the TabID field, IF it is empty (first run in a tab)
var tabIDfield = $("input[name=TabID]");
if (tabIDfield.length && tabIDfield.val() == "") {
    var guid = your_guid_algo_here();
    tabIDfield.val(guid);
}

3. on submit/post, your php handler code stores your variables nested within this TabID field so that it can be retrieved later on a per tab basis
$name = $_POST['name'];
$email = $_POST['email'];
$tabID = $_POST['TabID'];
$_SESSION[$tabID] = array(
  'name' => $name,
  'email' => $email
);

4. whenever you need to pull out info on a tab basis, make sure it is retrieved from the multi-dim array:
echo "Your tab's session email is " . $_SESSION[$tabID]['email'];

for this to work all actions in your app would have to post the guid field.

 

[natnai]

Yah i think session_name() is not designed to use that way. My initial concern was to use some random digits to for the session id so as to prevent anyone to guess it. And now i have problem passing it through the pages without having a form to post it.

The idea below is nice and simple for session management across tabs. But right now i need to change to a constant value for the session cookie name as well as including the new tab ID in all the pages ... seems like a revamp

Also thanks to all who have contributed their valuable input

You don't have to revamp. Just make a session manager class and DI it into your script.

Sent from Xiaomi MI NOTE LTE using GAGT