Question

I’m working on a login script. When the user successfully logs in I set $_SESSION['logged_in'] = TRUE;

Then, I simply check on other pages if $_SESSION['logged_in'] = TRUE; If so, I display the appropriate content

Everything works fine, but now I’m adding more security. Would it be beneficial for me to check the session_id of the current user against the session_id stored in the database upon login? Would this help prevent session hijacking? If not, are there other preventative measures I should be taking?

Answer 1

No, it would not be beneficial to check the session_id against the one stored in the DB. If a session is hijacked that means that the hijacker has the session id. So checking it against the DB would only reveal that the the hijacker has a valid session token.

You could, as noko said, check the IP, but then that is something else you would need to store and something else you would need to do on every request. Checking the user-agent would be pointless.

The best things you can do to prvent session hijacking are:

1. Use TLS/SSL for your login form and every page after the user logs in.
   Ideally, using it for everything is best.
2. Rotate your session token after the user logs in. If a user’s session_id is compromised before they log in, it will still be compromised after they log in.
3. Ensure you are using sufficiently random session tokens. This will make them difficult to guess and will make brute-force attacks against your session management very, very difficult.

UPDATE: To elaborate on #3 (as requested) I will quote from and refer to the OWASP Session Management Cheat Sheet

The session ID must be long enough to prevent brute force attacks,
where an attacker can go through the whole range of ID values and
verify the existence of valid sessions. The session ID length must be
at least 128 bits (16 bytes).

AND

The session ID must be unpredictable (random enough) to prevent
guessing attacks, where an attacker is able to guess or predict the ID
of a valid session through statistical analysis techniques. For this
purpose, a good PRNG (Pseudo Random Number Generator) must be used.
The session ID value must provide at least 64 bits of entropy (if a
good PRNG is used, this value is estimated to be half the length of
the session ID).