mirror of
https://github.com/sigmasternchen/php-doc-en
synced 2025-03-27 06:18:56 +00:00
96c9d88bad
git-svn-id: https://svn.php.net/repository/phpdoc/en/trunk@297028 c90b9560-bf6c-de11-be94-00142212c4b1
56 lines
2.1 KiB
XML
56 lines
2.1 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!-- $Revision$ -->
|
|
|
|
<chapter xml:id="session.security" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
|
|
<title>Sessions and security</title>
|
|
<para>
|
|
External links: <link xlink:href="&url.session-fixation;">Session fixation</link>
|
|
</para>
|
|
<para>
|
|
The session module cannot guarantee that the information you store
|
|
in a session is only viewed by the user who created the session. You need
|
|
to take additional measures to actively protect the integrity of the
|
|
session, depending on the value associated with it.
|
|
</para>
|
|
<para>
|
|
Assess the importance of the data carried by your sessions and deploy
|
|
additional protections -- this usually comes at a price, reduced
|
|
convenience for the user. For example, if you want to protect users from
|
|
simple social engineering tactics, you need to enable
|
|
<literal>session.use_only_cookies</literal>. In that case,
|
|
cookies must be enabled unconditionally on the user side, or
|
|
sessions will not work.
|
|
</para>
|
|
<para>
|
|
There are several ways to leak an existing session id to third parties.
|
|
A leaked session id enables the third party to access all resources which
|
|
are associated with a specific id. First, URLs carrying session ids. If
|
|
you link to an external site, the URL including the session id might be
|
|
stored in the external site's referrer logs. Second, a more active
|
|
attacker might listen to your network traffic. If it is not encrypted,
|
|
session ids will flow in plain text over the network. The solution here
|
|
is to implement SSL on your server and make it mandatory for users.
|
|
</para>
|
|
</chapter>
|
|
|
|
<!-- Keep this comment at the end of the file
|
|
Local variables:
|
|
mode: sgml
|
|
sgml-omittag:t
|
|
sgml-shorttag:t
|
|
sgml-minimize-attributes:nil
|
|
sgml-always-quote-attributes:t
|
|
sgml-indent-step:1
|
|
sgml-indent-data:t
|
|
indent-tabs-mode:nil
|
|
sgml-parent-document:nil
|
|
sgml-default-dtd-file:"~/.phpdoc/manual.ced"
|
|
sgml-exposed-tags:nil
|
|
sgml-local-catalogs:nil
|
|
sgml-local-ecat-files:nil
|
|
End:
|
|
vim600: syn=xml fen fdm=syntax fdl=2 si
|
|
vim: et tw=78 syn=sgml
|
|
vi: ts=1 sw=1
|
|
-->
|
|
|