deblan/pdnsmanager
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Added more protection against session theft

Browse source
This commit is contained in:
Lukas Metzger 2016-01-29 15:39:40 +01:00
parent 8db64004ca
commit 243e9b045f
3 changed files with 14 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
api/index.php
View file

@ -35,6 +35,11 @@ if (password_verify($input->password, $password)) {
$_SESSION['id'] = $id; $_SESSION['id'] = $id;
$_SESSION['type'] = $type; $_SESSION['type'] = $type;
$randomSecret = base64_encode(openssl_random_pseudo_bytes(32));
$_SESSION['secret'] = $randomSecret;
setcookie("authSecret", $randomSecret, 0, "/", "", false, true);
} else { } else {
$retval['status'] = "fail"; $retval['status'] = "fail";
} }

9
lib/session.php
View file

@ -18,7 +18,14 @@
session_start(); session_start();
if(!isset($_SESSION['id'])) {
if(
!isset($_SESSION['id']) ||
!isset($_SESSION['secret']) ||
!isset($_COOKIE['authSecret']) ||
$_SESSION['secret'] !== $_COOKIE['authSecret']
) {
header('Location: index.php'); header('Location: index.php');
session_destroy();
exit(); exit();
} }

1
logout.php
View file

@ -17,6 +17,7 @@ limitations under the License.
<?php <?php
require_once 'lib/session.php'; require_once 'lib/session.php';
session_destroy(); session_destroy();
setcookie("authSecret", "", 1, "/", "", false, true);
?> ?>
<html> <html>
<head> <head>