Join David Powers for an in-depth discussion in this video How PHP sessions work, part of PHP: Managing Persistent Sessions.
- In this chapter, we'll take a detailed look at the security implications of sessions, starting with a very basic overview of How PHP Sessions Work. This will lay the foundation for devising a strategy to minimize the risks of persistent sessions that don't require users to log in each time they visit a site. Basic communication between a browser and a web server is stateless. What that means is the browser sends a request to the web server, and the server responds by sending the requested web page and associated assets, such as images and style sheets.
Apart from knowing where to send everything, the server has no interest in who you are. Each request and response is treated independently. This stateless communication makes it impossible to preserve detail such as the visitor's name, preferences, or contents of a shopping cart. Cookies are one way of preserving information across multiple requests. The browser sends the request to the web server in the normal way. When the server responds, it sends a cookie for the browser to store.
This is a series of name-value pairs to identify the user together with information that's to be preserved between requests. The next time the browser sends a request, all the information in the cookie is sent back to the server. Although cookies can be encrypted, there's a danger that the information can be intercepted. It's also inefficient to keep sending information back and forth. Sessions overcome these problems using a combination of a cookie and server-side storage.
The browser sends a request to the server. PHP responds by sending a unique token that identifies the current session. This is known as the session ID. In all subsequent requests, the browser sends the session ID to say, "Hey, it's me again." All other data related to the session is stored on the web server. Only the session ID gets passed back and forth. There are two ways of propagating the session ID.
It doesn't need to be the very first line of the script, but it must come before any output is sent to the browser. You store data that you want to be available throughout your application as session variables by adding them to the SESSION superglobal array. This example creates a session variable called 'authenticated' and sets its value to true. If the value comes from user input, it's often a good idea to sanitize it before storing it as a session variable.
In this example, 'name' comes from the POST array, so it's passed to htmlentities() before being assigned to SESSION 'name' If you don't sanitize user input at this stage, you need to remember to do so each time you display a value stored in a session variable. SESSION is a superglobal array, so it's available in every page that invokes session_start() By default, the cookie that stores the session ID expires when the browser is closed, but the data associated with the session isn't automatically deleted at the same time.
It often remains on the web server where it's stored in plain text. For security, it's best to delete session data that's no longer needed. However, it's difficult to guarantee that users will log out before leaving your site so it's not always possible. But that doesn't mean the data remains on the web server indefinitely. PHP garbage collection runs periodically to remove session data files that are out of date. This has implications for creating persistent sessions.
First of all, we need to make sure that a cookie identifying the user remains active even after the browser has been closed. We need to make sure that session data isn't garbage collected until it's genuinely no longer needed. And we need to store the data as securely as possible. With these points in mind, we'll next examine the options for configuring PHP sessions.
- Configuring sessions
- Inspecting how session data is stored
- Implementing persistent sessions
- Creating a SQL database to store session data
- Implementing the PHP SessionHandlerInterface
- Writing session data
- Closing and destroying sessions
- Creating an auto-login system with persistent sessions
- Creating persistent logins
- Checking out visitor credentials
- Authenticating users
- Logging out users selectively