Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I've been using session middleware to build web apps for years: from PHP's built-in session handling layer to node's connect session middleware. However, I've never tried (or needed) to roll my own session handling layer. How would one go about it? What sort of checks are necessary to provide at least some modicum of security against HTTP session highjacking?

I figure setting a cookie with a token to keep track of the session, and then perhaps some check to see that the originating IP address of the session doesn't change and that the client browser software remains consistent. Hoping to hear about current best-practices...

share|improve this question
1  
IP addresses change constantly - I switch between Wifi and mobile networks as I go and expect services to continue etc. and simulating HTTP headers to claim to be the same browser is the first thing an attacker does ;-) –  johannes Jun 10 at 15:51
    
Good point @johannes. How then to provide some basic protection against session high jacking? Or does that all rest on just the cookie that must be kept private? –  BBnyc Jun 10 at 16:12
    
Use http only sessions (no javascript based exploits that easily), use https (harder to intercept cookie), regenerate often (short time frame for attacker) –  johannes Jun 10 at 18:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.