Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Session hijacking prevention #1521

Closed
nadar opened this issue Sep 26, 2017 · 2 comments
Closed

Session hijacking prevention #1521

nadar opened this issue Sep 26, 2017 · 2 comments
Assignees
@nadar
Labels
enhancement
Milestone
1.0.0

Comments

@nadar
Copy link
Member

nadar commented Sep 26, 2017

In order to prevent session hijacking bind session id to current ip adresse in database and make sure its the same on each request.
@nadar nadar added this to the 1.0.0 milestone Sep 26, 2017
@nadar nadar self-assigned this Sep 26, 2017
nadar added a commit that referenced this issue Sep 26, 2017
@nadar
add new session and ip check on each login request #1521
7a4d453
nadar added a commit that referenced this issue Sep 26, 2017
@nadar
logout when request is 403 or 405 in addition to 401 #1521
9a168d3
@nadar nadar closed this as completed in 248b696 Oct 2, 2017
@nadar nadar reopened this Oct 2, 2017
nadar added a commit that referenced this issue Oct 2, 2017
@nadar
add host based secure variables #1521
e75f314
@nadar nadar changed the title Prevent session hijacking prevention Session hijacking prevention Oct 4, 2017
@nadar
Copy link
Member Author

nadar commented Oct 4, 2017 •
edited
Loading

Due to yii2-debug toolbar which implements the user panel and trys to regenerate the session in yii\web\User unexpected logouts appear.

@nadar
Copy link
Member Author

nadar commented Oct 9, 2017

In order to conflict with the yii2 web user behavior:

  • admin user logins add new flag is_destroyed
  • check only for instance from the user ip where is destroyed not false.

nadar added a commit that referenced this issue Oct 9, 2017
@nadar
fixed issue with session hijack prevention, token is now bound to an ip.
2702dcb 
#1521
@nadar nadar closed this as completed Oct 17, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@nadar nadar

Labels
enhancement
Projects
None yet
Milestone
1.0.0
Development

No branches or pull requests
1 participant
@nadar