PHP - checking logged in

[evenflow]

I have a login page that, all being well, sets:

$_SESSION['loggedin'] = 1;

On another page, I want to only display certain content to logged in users. Is it secure enough just to use:

if ($_SESSION['loggedin']==1) {
// display logged in content
}

...or can the session variable be somehow set externally or spoofed?

Cheers.

ETA double equals sign

Edited by evenflow on Tuesday 16th March 18:18

[Esseesse]

Yes it is enough (bloody hope so anyway or I'm fked!!). The only thing that a user could ever see is the session id, not the variables that are set for that session id.

[-DeaDLocK-]

Yes, it will be fine.

Couple of tips:

<?php if ($_SESSION['loggedin']==1): ?>
<!-- Logged in content in normal HTML -->
<?php endif; ?>

The above achieves the same thing, but I find it is easier to work with. Also good practice to "else" some content for a not logged in user. In the above syntax, it would look like this:

<?php if ($_SESSION['loggedin']==1): ?>
<!-- Logged in content in normal HTML -->
<?php else: ?>
<!-- Not logged in content in normal HTML -->
<?php endif; ?>

[Esseesse]

-DeaDLocK- said:

Yes, it will be fine.

Couple of tips:

<?php if ($_SESSION['loggedin']==1): ?>
<!-- Logged in content in normal HTML -->
<?php endif; ?>

The above achieves the same thing, but I find it is easier to work with. Also good practice to "else" some content for a not logged in user. In the above syntax, it would look like this:

<?php if ($_SESSION['loggedin']==1): ?>
<!-- Logged in content in normal HTML -->
<?php else: ?>
<!-- Not logged in content in normal HTML -->
<?php endif; ?>

I code somewhat bizarrely I think. Always found it so much easier to read structuring things like this... anybody else the same?


if ($_SESSION['loggedin']==1)
. . {
. . // display logged in content

. . if (something else)
. . . . {
. . . . // do something else
. . . . }
. . }
else
. . {
. . // some other stuff...
. . }

Edited because of course, PH edits my formatting!

Please ignore the dots.

Edited by Esseesse on Wednesday 17th March 12:04

Edited by Esseesse on Wednesday 17th March 12:07

[-DeaDLocK-]

Esseesse said:

I code somewhat bizarrely I think. Always found it so much easier to read structuring things like this... anybody else the same?

No, not at all. I think the majority of people probably do it your way, and it's pretty standard.

I personally don't like messing around with prints and echos, especially when they include vast amounts of HTML tags (also makes it easier with syntax highlighting and such), so most of the time I prefer to place the HTML outside of the PHP tags.

[sonic_2k_uk]

It's basic, the security of this will depend on how you have sessions configured.

You want to make sure use_only_cookies is set and you have your cookie parameters defined. I'd also be setting cache expiration headers e.g.

// Set session related ini settings

ini_set ('session.use_only_cookies', 1);
ini_set ('mbstring.http_output', 'UTF-8');

// Set session cookie parameters

session_set_cookie_params (86400, '/');

// Start session

session_start ();

// Send cache headers

header ("Expires: Sun, 23 Nov 1984 03:13:37 GMT");
header ("Last-Modified: " . gmdate ("D, d M Y H:i:s") . " GMT");
header ("Cache-Control: no-store, no-cache, must-revalidate");
header ("Cache-Control: post-check=0, pre-check=0", FALSE);
header ("Pragma: no-cache");

I tend to set the authenticated user id in the session and check user account status at each script request. I also set a login and last action timestamp to record session duration, click events and a custom session lifetime i.e if they don't do anything for 30 minutes make them re-login.

Edited by sonic_2k_uk on Wednesday 17th March 12:57

[evenflow]

sonic_2k_uk said:

I tend to set the authenticated user id in the session

As a session variable?

sonic_2k_uk said:

and check user account status at each script request

When you say account status, do you mean checking for example whether they are an active account in the database?

sonic_2k_uk said:

I also set a login and last action timestamp to record session duration, click events and a custom session lifetime i.e if they don't do anything for 30 minutes make them re-login.

I'd be really interested to see the code for this.

ETA: Presumably this is a timestamp you log in the DB, then next time they click, check current time against that DB entry and force re-login if more than 30mins?

Edited by evenflow on Wednesday 17th March 13:21

[sonic_2k_uk]

evenflow said:

sonic_2k_uk said:

I tend to set the authenticated user id in the session

As a session variable?

sonic_2k_uk said:

and check user account status at each script request

When you say account status, do you mean checking for example whether they are an active account in the database?

Yes for both, in the latter is means if you were to disable the account they would not be able to do anything, whereas if you didn't check this at each request you'd have to wait until their session was reset before they were disabled.

Say have a users table with id, username, hashed password (don't use md5 btw), state, last login and last click. If you're doing a really basic multi-user system you might have some status field which allows elevated permissions, or if you're doing a more advanced permission based system you might have separate user permissions tables with additional permission and permission group tables.

Your state would be enum (0,1) i.e disabled/enabled, and just load the user credentials at each user session instantiation and check the user is not disabled. Or you could set the user state in the session and check for a state change at each request, then react to it.

evenflow said:

sonic_2k_uk said:

I also set a login and last action timestamp to record session duration, click events and a custom session lifetime i.e if they don't do anything for 30 minutes make them re-login.

I'd be really interested to see the code for this.

ETA: Presumably this is a timestamp you log in the DB, then next time they click, check current time against that DB entry and force re-login if more than 30mins?

I set the login time and last action time in the session and database when the user logs in, you can then check for a login time in the session as another validation method. You could also log them out after being logged in for say an hour, which might be helpful if you are offering a demo subscription service where they can only stay logged in for a certain amount of time.

Updating the login and request times in the user database is pretty basic and may be somewhat unnecessary if you're setting it in the session. I typically use a more advanced logging structure, but it would allow you to do things based upon the users last login time without the session e.g. "Welcome back user, sorry we haven't seen you for 14 days."

You could also check the session last action time against the database last action time for the user as a basic method to stop multiple people being logged in as the same user.

Whenever a request is made you can then check the last action time in the session and act accordingly, e.g. this is running on a custom session object i use:

session object said:

public function checkTimeout ()
{


// Check the account hasn't been inactive for to long

if ($this->get('last_action') > (time () - $this->intTimeout))
{

return FALSE;

}
else
{

return TRUE;

}

}

And then in the session checking for my user object...

user object said:

// If the session has timed out

if ($this->objSession->checkTimeout ())
{

// Call the logout method

$this->Logout ('timeout');

// Return FALSE

return FALSE;

}

So simply logout the user if they haven't done anything in the specified period.

Edited by sonic_2k_uk on Wednesday 17th March 14:56

[evenflow]

Thanks for taking the time to write all that out. Really interesting stuff to digest there.

sonic_2k_uk said:

hashed password (don't use md5 btw)

Funnily enough, I read about this the other day.
http://codahale.com/how-to-safely-store-a-password...

What do you use in a PHP/MySQL environment?

[sonic_2k_uk]

Interesting little article, cheers.

A hashing method is deemed broken if there is a way to find a collision quicker than a brute force attack. MD5 rainbow tables are widely available online and SHA-1 is going that way.

If you're using php 5 you can use the new hash function for something stronger. I'd be using SHA2 SHA-256 e.g. $var = hash ('sha256', 'password');

[-DeaDLocK-]

sonic_2k_uk said:

Interesting little article, cheers.

A hashing method is deemed broken if there is a way to find a collision quicker than a brute force attack. MD5 rainbow tables are widely available online and SHA-1 is going that way.

If you're using php 5 you can use the new hash function for something stronger. I'd be using SHA2 SHA-256 e.g. $var = hash ('sha256', 'password');

I just append a salt with SHA-1.

ETA: And that's a very useful article!

Edited by -DeaDLocK- on Wednesday 17th March 16:08