Question

What is the best way to know if user is the right guy and not a hacker?
For example in my project when user is logging in I create some session variable with some number and then on other pages I check this session variable and according to it’s value give user some options.

So can hacker change this variable somehow so server side will grant him access to some options ?

If so what is the best way of holding some users rights and passing them to different pages , so server can grant that user with some options ?

Answer 1

To understand Session Hijacking more clearly, there are several methods by which a hacker hijacks the session let me put some light on different types of session hijacking.

according to Wikipedia

There are four main methods used to perpetrate a session hijack:

1. Session fixation, where the attacker sets a user’s session id to one known to him, for example by sending the user an email with a link that contains a particular session id. The attacker now only has to wait until the user logs in.

2. Session sidejacking, where the attacker uses packet sniffing to read network traffic between two parties to steal the session cookie. Many web sites use SSL encryption for login pages to prevent attackers from seeing the password, but do not use encryption for the rest of the site once authenticated. This allows attackers that can read the network traffic to intercept all the data that is submitted to the server or web pages viewed by the client. Since this data includes the session cookie, it allows him to impersonate the victim, even if the password itself is not compromised.1 Unsecured Wi-Fi hotspots are particularly vulnerable, as anyone sharing the network will generally be able to read most of the web traffic between other nodes and the access point.

3. Alternatively, an attacker with physical access can simply attempt to steal the session key by, for example, obtaining the file or memory contents of the appropriate part of either the user’s computer or the server.

4. Cross-site scripting, where the attacker tricks the user’s computer into running code which is treated as trustworthy because it appears to belong to the server, allowing the attacker to obtain a copy of the cookie or perform other operations

While there are several solution to stop this kind of hijacking for example for the second one using a SSL or https would be appropriate to avoid it. however if you want to add more security for your session then one solution i came across is by allowing passing of seesionId’s via Cookies only, and generate and additional session token that is passed via URL. and only request that contain a valid Session toekn may access the session.

Below is the example demonstrating the example taken by Orielly PHP CookBook.

ini_set('session.use_only_cookies', true); 
session_start();
//Create a random salt value
$salt = 'Hjkhkjh9089&j98098';
$tokenstr = (str) date('W') . $salt; 
//Create a md5 hash to be used for token.
$token = md5($tokenstr);
if (!isset($_REQUEST['token']) || $_REQUEST['token'] != $token) { 
    // prompt for login
    exit; 
}
$_SESSION['token'] = $token; 
output_add_rewrite_var('token', $token); 

Now what output_add_rewrite_var does it it adds another name/value pair to the url rewrite mechanism via Get method. read more about the function here. output_add_rewrite_var

to read more about session security i suggest you read this article http://hungred.com/useful-information/solutions-session-attacks/

hope this helps you in understanding the vulnerabilities of sessions and how to fix it.