Do not generate insecure session IDs

문서 > 코드 분석 > Static Analysis Rules > Do not generate insecure session IDs

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Metadata

ID: php-security/insecure-session-id

Language: PHP

Severity: Error

Category: Security

CWE: 340

Description

Session IDs are vital to maintaining state in your web applications and thus, it’s crucial to ensure that these IDs are secure and not easily guessable. If an attacker is able to predict or guess a session ID, they can hijack a user’s session, gain unauthorized access to their data, and perform actions on their behalf. This can result in severe data breaches and loss of trust from your users.

To avoid violating this rule, always generate sufficiently long and random session IDs. Also, avoid setting session IDs from user input, as this can open up the possibility for session fixation attacks.

Non-Compliant Code Examples

<?php
session_id(bin2hex(random_bytes(6)));
session_id($_POST["s_id"]);

Compliant Code Examples

<?php
session_id(bin2hex(random_bytes(16)));
session_regenerate_id();