Strict session handling in PHP

PHP has a permissive session system. This has been decided way before I came into the PHP world (I guess in preparation of 4.0), and the reasons for this decision are kinda lost in transit. However, with a small patch by Hardened-PHP Project buddy Stefan esser, this might now change.

A small patch against PHP’s ext/session and ext/sqlite adds two new handler functions to validate and create session IDs, as well as the php.ini setting

session.use_strict_mode = 0/1

although under normal circumstances, a strict session mode handler will not bring extremely more security, it will put an end to session fixation (supplying a session ID and have it validated by PHP), some SQL injection issues (if, for tracking purposes, you store each session ID in a database) and some XSS that might arise from providing a session ID including HTML/JS code.

You can check out the patch at

http://www.suspekt.org/session_strict_mode.patch

It will also be part of the next release of the Hardening Patch for PHP.