On 25.01.2014 15:11, Andreas Heigl wrote:
> Am 25.01.14 04:15, schrieb Andrey Andreev:
>> On Sat, Jan 25, 2014 at 4:21 AM, Andrea Faulds <ajf@ajf.me> wrote:
>>>
>>>
>>> On 25/01/14 01:11, Andrey Andreev wrote:
>>>>
>>>> Yes, one can write a custom session handler, but there's a number of
>>>> problems with that:
>>>
>>>
>>> Correct me if I'm wrong, but why would you need to do that? Surely, this
>>> would suffice:
>>>
>>> if (!isset($_SESSION['ip'])) {
>>> $_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
>>> } else if ($_SERVER['REMOTE_ADDR'] !== $_SESSION['ip']) {
>>> session_destroy();
>>> }
>>>
>>
>> - I don't want the IP stored in session data, I already know it.
>> - filemtime() result of the potentially targeted session id is
>> changed, extending its expiry time
>> - multiple set-cookie headers
>>
>> Basically, I want it to be perfect. :)
>>
> Hi all.
>
> Don't bash me when I'm wrong, but why would you want the IP check for
> the session in the first place? Don't get me wrong, I'm definitely in
> favour of more security, but the issue I see, is the following:
> When a user has an ISP that regularrily changes the IP-address assigned
> to the user via DHCP the session then is lost, isn't it? So suddenly the
> user is logged of without any apparent reason whatsoever.
>
> And if that's not a problem, please take into account the users real
> address and not the address of any proxy that is in between (at least
> when it's possible to determin it). And that involves a lot of header
> checks, whether one or the other is set. And as soon as the appropriate
> header is not set (which might be the case due to proxy misbehaviour or
> misconfiguration), you will "only" have the IP of the Proxy. So all
> users behind such a proxy will share the same IP-address. The same goes
> for users behind NAT in a private network.
We have this security feature in userspace code in Horde 3-5, but it's
of limited value because all installations with corporate network users
need to turn it off (because their IPs are constantly changing).
--
Ralf Lang
Linux Consultant / Developer
Tel.: +49-170-6381563
Mail: lang@b1-systems.de
B1 Systems GmbH
Osterfeldstraße 7 / 85088 Vohburg / http://www.b1-systems.de
GF: Ralph Dehner / Unternehmenssitz: Vohburg / AG: Ingolstadt,HRB 3537
Attachment: [application/pgp-signature] OpenPGP digital signature signature.asc