PHP secure session by unique identifier

Question

New to sessions and just wondering if there is any possible that if (in our case) two bookings are being processed at the same time the session variables can get confused.

For example if user 1 makes a booking, the information stays in sessions while he logs in. Meanwhile another user makes a booking who is already logged in. Is their any chance that the sessions could get confused.

If the answer is yes, would the solution be to have a unique temporary name as part of the session names a bit like TMP name in file upload.

And if so, how to do it.

Many Thanks,

I'm not so sure but I think that server takes care of sessions so there's no chance for server to be confused this way. However, I'd also like to know if that's not true. — Wh1T3h4Ck5
– Wh1T3h4Ck5, Commented Mar 30, 2011 at 18:30
Are you referring to two users on the same computer? If they are in a different browser then they won't be interfered, but it is impossible to have two users in the same browser unless you code your own way. — Flipper
– Flipper, Commented Mar 30, 2011 at 18:31

k to the z · Accepted Answer · 2011-03-31 01:02:37Z

3

I believe the UID (what php assigns as a session ID) is randomly generated off of the server time, so the answer is no. No two people will be assigned the same UID.

edited Mar 31, 2011 at 1:02

answered Mar 30, 2011 at 18:26

k to the z

3,1952 gold badges29 silver badges41 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Alexis Wilke Over a year ago

It's not because it is random that it's not going to be the same. But there is a test to prevent duplication (i.e. on the second generation, if the generated ID exists, then it tries again until a unique ID is generated.)

Chris Salij · Accepted Answer · 2011-03-30 18:26:38Z

0

I don't see how the sessions could get confused. The server generates a unique session id for that user's session. On each page request the user's browser sends the session id to the server and the server validates that it's a valid session.

As long as the session ids are unique and the user doesn't discover another user's session id, then there is no rom for confusion.

answered Mar 30, 2011 at 18:26

Chris Salij

3,1365 gold badges27 silver badges43 bronze badges

Comments

Marc B · Accepted Answer · 2011-03-30 18:51:55Z

0

Session IDs are essentially just random numbers. It's HIGHLY unlikely, but NOT impossible for two or more users to get the same session ID.

PHP does (I believe) check if there's another session currently using the ID it's just generated. If there's a collision, it'll just generate another one, and keep trying until something "unique" comes up. However, this doesn't prevent the case where:

user A gets session ID 'X'
user A goes away for a while and session 'X' gets expired
user B shows up, and the server generates session ID 'X' again by random chance
user A comes back with their original session X cookie ID and gets user B's session.

Again, given the size of the session ID space, it's very very very unlikely for this to occur. But also again, it's not impossible.

Beyond that, there are cases where broken/misconfigured proxy servers get cookies confused and basically 'cross wires' so that session IDs get mixed up between different users. I remember a case where a mobile operator's gateway did just that, and people on a certain model of smartphone were getting other people's sessions instead of the one they'd been on.

answered Mar 30, 2011 at 18:51

Marc B

362k44 gold badges433 silver badges508 bronze badges

4 Comments

k to the z Over a year ago

In the third step of your example: I was under the impression that the epoc time was used to generate the random number. If that's true, then step three really can't happen. Put me in my place, sir. :)

Your Common Sense Over a year ago

PHP doesn't check. randomness alone is enough to prevent collisions.

Marc B Over a year ago

@k: Current time is one of the factors, but isn't the only factor. If it was purely a unix timestamp, then any visitors within the same 'second' would get the same ID.

k to the z Over a year ago

Agreed. I guess it's like a salt?

Your Common Sense · Accepted Answer · 2011-03-30 19:09:11Z

0

Just to extend Marc's answer a bit.

A possibility he is talking about is very similar to a possibility to be killed by meteorite from space.

So, in practice the answer is NO. You can rely on big numbers like everyone else does

answered Mar 30, 2011 at 19:09

Your Common Sense

158k42 gold badges226 silver badges374 bronze badges

Collectives™ on Stack Overflow

PHP secure session by unique identifier

4 Answers 4

1 Comment

Comments

4 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

Comments

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related