How to encrypt session id in cookie?

php session-hijacking
Moon picture Moon · Apr 11, 2010 · Viewed 14.7k times · Source

While I was reading about session hijacking articles, i learned that it would be nice to encrypt session id value that is stored in a cookie.

As far as I know, when I start a session by calling session_start(), PHP does not encrypt session id value in a cookie.

How do I encrypt session id value and then initialize session with it?

Answer

Matthew Flaschen picture Matthew Flaschen · Apr 11, 2010

Encrypting won't help. The session cookie is just a magic number anyway. Encrypting it just means there's a different magic number to hijack. Depending on what hijacking scenarios you have in mind, there are other possible mitigations. For example, you can limit sessions to a single IP. That poses some issues though, e.g. people switching between wireless points.

Related questions

Proper session hijacking prevention in PHP

I know this topic has been discussed a lot, but I have a few specific questions still not answered. For example: // **PREVENTING SESSION HIJACKING** // Prevents javascript XSS attacks aimed to steal the session ID ini_set('session.cookie_httponly', 1); // Adds …

Read More
How do I check if a string contains a specific word?

Consider: $a = 'How are you?'; if ($a contains 'are') echo 'true'; Suppose I have the code above, what is the correct way to write the statement if ($a contains 'are')?

Read More
Get the full URL in PHP

I use this code to get the full URL: $actual_link = 'http://'.$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF']; The problem is that I use some masks in my .htaccess, so what we see in the URL is not always …

Read More