dreamweaver login code :: regenerate session id

[stijn0713]

in dreamweaver login code, it regerates the session id before heading to the requested page. Why would one do that?

 

if ($loginFoundUser) {


			if (PHP_VERSION >= 5.1) {session_regenerate_id(true);} 
			else {session_regenerate_id();}

if (isset($_SESSION['PrevUrl'])) {
			  $MM_redirectLoginSuccess = $_SESSION['PrevUrl'];	
			}
			header("Location: " . $MM_redirectLoginSuccess );
		  }
		  else {
			header("Location: ". $MM_redirectLoginFailed );
		  }

 

What is the security benefit?

[xyph]

Prevents against session fixation. It's quite overkill, and only really NEEDS to be done when privileges are elevated. Nothing wrong with it though.

[Christian F.]

I'd say that going from a unlogged user to a registered user is a privilege escalation, and as such session ID regeneration should always be utilized in a login script. If not it would be rather trivial to hijack the account, fetch email addresses, or whatever else is associated with the account.

 

Also, the above script is not quite correct, as it's lacking a die () after the header redirects. It's necessary to kill the script after sending such a header, to prevent the PHP parser from parsing the rest of the code. Something that can cause problems and/or post a security risk.

[stijn0713]

i don't quite understand session hijacking or session fixation.

 

Pages are restricted based on, say:

 

 if (!(isset($_SESSION['Valid_user']))) { header("Location: ". login.php); } 

 

What can i do with the SID then?

[Christian F.]

Then you need to search the web for articles explaining how sessions work, and what session fixation and hijacking is.

[xyph]

Oh, I thought it was being changed on each request. Yes, it's to prevent fixation. It's pretty much an attacker tricking a victim into generating an ID he's crafted. Once the login happens, the attacker can then just access the restricted pages using the same session ID containing the victim's credentials. By regenerating the ID, you're destroying the crafted ID.