0

currently I'm working with cakephp and implementing user management in my project. today, i came across an issue in user session. i have generated a cookie to remember user's password in encrypted format The cookie restores session if users session goes expired. now i have tried transferring cookie to other browser from chrome to Mozilla using a cookie manager plugin. and i have found myself logged in in both browser what is the best way to prevent this. ??

Improve this question
4
  • If your "remember-me" token is md5 of IP address then it's predictable. You should combine several bits of data before generating the token. md5($useragent.$ip) at the least, still predictable. Commented Sep 28, 2014 at 22:38
  • in a country like India ip of a user changes every time he connect to internet... then he will be logged out every time.. Commented Sep 29, 2014 at 5:39
  • Oh yeah, IP is often used in session token generation. For remember-me, something like md5($email.$hashed_password.$useragent) is a better start. Commented Sep 29, 2014 at 22:13
  • possible duplicate of Do you consider session replication as a security risk? Commented Sep 30, 2014 at 18:54

1 Answer 1

Reset to default
2

You can't prevent this. However, you can reduce the problem by having a session value generated server-side when the user starts a new session, which is some hash made from

  • The session ID
  • The user agent (attacker would have to use/spoof the same client)
  • Possibly the IP (would only work for fixed devices, but makes it much harder for an attacker)

Now when a logged in user tries to view a page requiring you to be logged in, you can compare more details than just the session lookup.

It's not impossible to spoof, but this reduces the problem. This hash should never be actually sent to the client, just kept in the session information server-side.

Improve this answer
Sign up to request clarification or add additional context in comments.

2 Comments

how facebook is doing this ??
Facebook is using Symb-like system to store cookies.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.