PHP Session Security Flaw?

Question

I'm new to php coding, and basically I'm creating a user panel where users login and from there they access their dashboard which lets them do things.

I'm using php sessions to do this, and basically at the top of the dashboard I put:

session_start();
if(!session_is_registered(myusername)){
header("location:index.php");

This makes it so users who aren't logged in are re-directed to index.php.

The problem is that there is certain commands users can do from dashboard, like this: /dashboard.php?reset=true

And doing these commands does not require active session for some reason. Anyone can just go to /dashboard.php?reset=true and reset everything, without an active session!

Does anybody know how to fix this security flaw which allows people to do this?

Thanks

That sounds like a security flaw in your implementation of /dashboard.php?reset=true rather than PHP. A session, by definition, requires the client to present a token with each request (either by cookie or query string). That does not mean you have to look for it before taking action. Could you post that bit of code (doing the reset) and the rest of your security checks? The problem may lie there. — jheddings
– jheddings, Commented Nov 20, 2012 at 5:14
Missing exit;. And pretty sure that's not how session_is_registered was to be used (note the past tense). — mario
– mario, Commented Nov 20, 2012 at 5:14

Divyesh · Accepted Answer · 2012-11-20 05:49:02Z

2

Quick answer : you could put the same code in the /dashboard.php? file

Better verfy if the user is an admin by declaring a sessionvariable.

when logged in before redirecting :

session_start();
$_SESSION['is_admin']="yes" ;

In the "execution files" :

if(isset() && $_SESSION['is_admin'] == "yes")
{
  //do your thing
}
else
{
   echo : "you are not allowed to do that";
}

for more security tips : link it will point out some security issues for you

edited Nov 20, 2012 at 5:49

Divyesh

5274 silver badges18 bronze badges

answered Nov 20, 2012 at 5:33

Jeffrey Nicholson Carré

3,0381 gold badge28 silver badges46 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Jeffrey Nicholson Carré Over a year ago

as it was poited out by Dev don't forget to start the session

Ed Heal · Accepted Answer · 2012-11-20 05:17:13Z

0

I guess that by reset you mean password. Just get that part to ask them for the old password as well as the new old. And to stop robots use summat like CAPTCHA,

answered Nov 20, 2012 at 5:17

Ed Heal

60.3k18 gold badges91 silver badges137 bronze badges

Comments

whamma · Accepted Answer · 2012-11-20 05:20:24Z

0

You need to put a die or exit or some other way of terminating after your header() call. header() doesn't stop execution, so even though it's sending the Location: redirect, it's going to keep going down through your code.

answered Nov 20, 2012 at 5:20

whamma

8,3781 gold badge17 silver badges19 bronze badges

Comments

Ravi · Accepted Answer · 2012-11-20 05:26:28Z

0

Might be you are using php 5.4.x

session_is_registered has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0.

Use isset($_SESSION['myusername']) instead of session_is_registered

Edit

exit should always be put after redirecting from header, die will work too.

answered Nov 20, 2012 at 5:26

Ravi

2,08613 silver badges23 bronze badges

2 Comments

user1837725 Over a year ago

Does isset($_SESSION['myusername']) function still work on 5.3.0?

user1837725 Over a year ago

Thanks man it works great, this website is great I will stick around!

Collectives™ on Stack Overflow

PHP Session Security Flaw?

4 Answers 4

1 Comment

Comments

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related