Question

I’m using the following code for my user login. Everything works fine but im just wondering the security of using this. I’m using the userid as the sessionid when a user logs in.

What are my security issues with using this?

Can the user change the sessionid to a different number and then be logged in as a different user? (how do i stop this?)

if (!empty($row['member_id']))
     {
    $_SESSION['id'] = $row['member_id'];
    header ("Location: team.php");
    exit();

Answer 1

I’m not a security expert by any means.

There was an uproar back in, I want to say, 2010 about session theft. So much so that a group put out a tool called Firesheep that would let you quickly steal other sessions in an open wifi situation. The solution is to protect the entire logged in session with SSL or not be on an open network. Back when SSL was first being used, it proved too slow to be used as a session long security measure, but now computing is fast enough.

TLDR: If you don’t SSL, someone can steal your session. Facebook and Google both had the same problem.

For clarification, they can’t “steal” sessions so much as they can find out the SESSIONID being passed around in the POST request in order to keep you logged in and then modify their cookies to send that around as you instead. The Firesheep tool could snag Facebook logins in seconds. By modifying the cookie with someone else’s SESSIONID, the tool was able to pretend to be the original user, allowing full access to the areas of the account that were unlocked upon login. See also: this.

Another good solution to help things is to reprompt the user during any account sensitive activity regardless of their session. For instance, if they try to change their password or change other account info, make sure to ask for their current password again.

The contents of the $_SESSION server-side are only safe as long as there is no way to submit user data in any way that would eventually end up in the session variable. If someone stole a SESSIONID and then entered data on some form (or if you blindly use the name of the form element as the index into the $_SESSION array) they could get stuff in there. The key is to never ever ever ever ever ever ever ever…EVER….trust what the client side has sent as valid or trustworthy. Paranoia is your friend.