Lesson 3.2: Protecting sessions and cookies
After login, the session cookie is the user. How sessions are stolen (cross-site scripting, unencrypted networks, URLs, guessable IDs) and fixed on a victim (session fixation), and the defences: the cookie attributes Secure, HttpOnly and SameSite, a new session ID at login, timeouts and real logout. In the lab you look at the shop's session cookie, find the session data PHP keeps on the server, check that the login code renews the session ID, add the missing cookie attributes in PHP and prove them with curl.
17 min
You will learn to
- Explain session hijacking and session fixation
- Explain the Secure, HttpOnly and SameSite cookie attributes
- Find where PHP stores sessions
- Set cookie attributes with session_set_cookie_params
- Explain why login must renew the session ID and logout must destroy the session
Key terms
- Session hijacking
- Taking over a logged-in session by stealing or guessing its session ID.
- Session fixation
- Making a victim use a session ID the attacker already knows, then waiting for the victim to log in with it.
- Secure
- Cookie attribute: send this cookie only over HTTPS.
- HttpOnly
- Cookie attribute: JavaScript on the page can't read this cookie.
- SameSite
- Cookie attribute that controls whether the cookie is sent with requests started by other sites: Strict (never), Lax (only top-level links), None (always, needs Secure).
- Session timeout
- Ending a session after a period of inactivity or a maximum age.
← Private addresses, NAT and port forwarding · All lessons · The Cyber Kill Chain: an attack step by step →