How to encrypt session id in cookie?

Posted by terrani on Stack Overflow See other posts from Stack Overflow or by terrani
Published on 2010-04-11T00:13:18Z Indexed on 2010/04/11 0:23 UTC
Read the original article Hit count: 646

Filed under:

php

|

session-hijacking

While I was reading about session hijacking articles, i learned that it would be nice to encrypt session id value that is stored in a cookie.

As far as I know, when I start a session by calling session_start(), PHP does not encrypt session id value in a cookie.

How do I encrypt session id value and then initialize session with it?

© Stack Overflow or respective owner

Related posts about php

Magento, NGINX, PHP-FPM, APC, MEMCACHED, 16gb Ram CentOS, Spiking PHP-FPM to 100% CPU

as seen on Server Fault - Search for 'Server Fault'
I have been trying to resolve my issue of spiking cpu caused by php-fpm processes. I've reduced the php-fpm config settings to: pm = ondemand pm.max_children = 12 pm.start_servers = 2 pm.min_spare_servers = 2 pm.max_spare_servers = 10 pm.max_requests = 500 php_admin_value[memory_limit] = 128M Problem… >>> More
PHP Pear Installation on CentOS

as seen on Server Fault - Search for 'Server Fault'
[root@ip ~]# yum install php-pear* Reducing CentOS-5 Testing to included packages only Finished Setting up Install Process Package 1:php-pear-1.8.1-2.el5.centos.noarch already installed and latest versio … >>> More
Apache configurations for php "AddType text/html php" or "AddType application/x-httpd-php php .php"

as seen on Server Fault - Search for 'Server Fault'
I am taking over an application server and discover that it contain the following settings: AddType text/html php Although it works, but my understanding is that it should set as following: AddType application/x-httpd-php php .php What are the key differences between the two settings?… >>> More
mod_rewrite settings causes server to throw HTTP 500 errors instead of 404

as seen on Server Fault - Search for 'Server Fault'
Hello. I have a server with VBulletin forum (working under Apache 2.2, CentOS). The default settings for it in .htaccess are as follows: RewriteEngine on RewriteCond %{HTTP_HOST} ^gsmforum\.ru RewriteRule (.*) http://www.gsmforum.ru/$1 [R=301,L] # If you are having problems or are using VirtualDocumentRoot… >>> More
Problems installing Memcache (PECL extension)

as seen on Server Fault - Search for 'Server Fault'
I have installed memcached fine, and now I will need to install PECL extension memcache. Im running RedHat x86_64 es5. The installation gives me this: downloading memcache-2.2.6.tgz ... Starting to download memcache-2.2.6.tgz (35,957 bytes) ..........done: 35,957 bytes 11 source files, building running:… >>> More

Related posts about session-hijacking

Avoiding session hijacking with Kohana

as seen on Stack Overflow - Search for 'Stack Overflow'
Do I have to do anything special to avoid session hijacking using Kohana framework? (Assuming the session is manipulated only with the Kohana Session library) Thanks in advance >>> More
How to prevent asp.net application from session hijacking?

as seen on Stack Overflow - Search for 'Stack Overflow'
I have read an article about session hijacking. please tell me asp.net session is how much secure. can people also do session hijacking with asp.net session. and also tell me how can i prevent my application from session hijacking. if you have any good example than also tell me that how people do… >>> More
Session hijacking prevention...how far will my script get me? additional prevention procedures?

as seen on Stack Overflow - Search for 'Stack Overflow'
When the user logs in the current session vairables are set $_SESSION['user']['timeout'] = time(); $_SESSION['user']['ip'] = $_SERVER['REMOTE_ADDR']; $_SESSION['user']['agent'] = $_SERVER['HTTP_USER_AGENT']; In my common.php page (required on ALL php pages) i have used the below script, which resets… >>> More
How to prevent session hijacking with SID (CGI perl)

as seen on Stack Overflow - Search for 'Stack Overflow'
I have a web app used by a small number of people (internal only) and am using a randomised sessionID that is stored under the user record and placed in various links. I have had a problem where users are sending links to each other which is allowing them to hijack the sender's session. What are… >>> More
How to encrypt session id in cookie?

as seen on Stack Overflow - Search for 'Stack Overflow'
While I was reading about session hijacking articles, i learned that it would be nice to encrypt session id value that is stored in a cookie. As far as I know, when I start a session by calling session_start(), PHP does not encrypt session id value in a cookie. How do I encrypt session id value… >>> More