tyler.durden/icingaweb2
1
0
Fork 0
mirror of https://github.com/Icinga/icingaweb2.git synced 2025-04-08 17:15:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refresh session id on Authentication

Browse Source 
To prevent session fixation, create a new session id each time authenticate is
called.

refs #5625
This commit is contained in:
Matthias Jentsch 2014-02-26 19:23:34 +01:00
parent bcfebcd937
commit 99668e87e5
3 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
library/Icinga/Authentication/Manager.php
View File

@ -369,6 +369,9 @@ class Manager
);
if ($persist == true) {
// Refresh the used session ID on each login, to offer protection against session fixation
$session = Session::getSession();
$session->refreshId();
$this->persistCurrentUser();
}

10
library/Icinga/Session/PhpSession.php
View File

@ -205,4 +205,14 @@ class PhpSession extends Session
);
}
}
/**
* Assign a new sessionId to the currently active session
*/
public function refreshId()
{
$this->open();
session_regenerate_id();
session_write_close();
}
}

5
library/Icinga/Session/Session.php
View File

@ -57,6 +57,11 @@ abstract class Session extends SessionNamespace
*/
abstract public function purge();
/**
* Assign a new session id to this session.
*/
abstract public function refreshId();
/**
* Get or create a new session namespace
*