symfony/symfony — Issue #3247: [Session] Introduce secure attributes to prevent session hijacking
Author: bschussek
Created: 2012-02-02 08:07:22+00:00
State: open
Labels: Feature, HttpFoundation

Now that the sessions are being reworked by @drak, I would like to introduce another feature which in my opinion is critical for secure websites: Secure session attributes.

The idea is to add a `getSecureAttributes` accessor to Session, which returns a list of attributes *but only* if the user is connected via HTTPS. All sensitive information that should only be available in HTTPS requests should then be stored there.

Example:

if ($loggedIn) {
// User will only appear logged in when connecting via HTTPS
// Malicious users cannot hijack this session
$session->getSecureAttributes()->set('user_id', $user->getId());
}

Secure attributes are stored in the normal session but under a namespace with a generated name. In a previous implementation of mine, the name was an SHA1 hash of

* `microtime(true)`
* `session_id()`
* a secret stored in the app configuration

The namespace name is transmitted to the user in a *secure* cookie. The user retransmits this cookie to the server everytime he makes an HTTPS connection, and this way the server can only access the sensitive information in such requests.