Security with PHP Sessions
I'm not a security expert. However, I humbly doubt that your security enforcements will bring substantial benefits.
If there's one who can steal the session ID of your users, for example by eavesdropping an unencrypted wireless network, I bet he can steal also the username and password your users send to your server when they authenticate. Once he has the access credentials, the attacker can login the day after, or a week after, and will have his "safe" - and 100% valid - session to play with.
I believe there is no session security without channel security. If you use SSL, you ensure that the session ID is sent only via cookies (you're already doing it) and your sessions expire soon, I believe you are reasonably safe, and safer than making these enforcement on an insecure channel.
Session security risks come from three different possibilities:
- Prediction
- Capture
- Fixation
Prediction would mean that someone that's not the user for whom the session was created guessed their session ID. The chances of that happening are almost 0, although they do grow as more users use the site simultaneously.
With your code, you would make that risk even lower because it would only work if the attacker shared the user agent and the ip of the predicted session. But the difference is trivial in this case.
Fixation would mean that an attacker can create a session and then force another user into using their session. In this case it would depend: If the attacker knows that you are doing it and they fake the user agent and ip of the client, they could fixate the session. Or if they share ip and user agent.
And finally we have session hijacking, probably the most common method of the three. In this case an attacker would somehow gain access to the session id of a valid logged in user, and then use it to log in to their account. As with the previous method, this would only work for them if they know that you are checking the ip and user agent, and faked the same ones as the user. The technique you are using is not unique, and some attackers might fake them just in case.
That being said, is it secure? Yes and no
If you are obsessed with security, the answer is always the same: Use SSL
Unless your code is open source, almost anything you do that changes the behavior of the php sessions will be secure enough.
The only exception to that would be really popular sites that will attract the attention of hackers.
There is some very good documentation on this topic available:
- http://phpsec.org/projects/guide/4.html
- PHP Session Security
- http://www.squarefree.com/securitytips/web-developers.html#CSRF