Session hijacking or attack?

Question

Lately I have seen this in my error log (1 per day, and I have 40k visitors per day):

[22-Sep-2009 21:13:52] PHP Warning: session_start() [function.session-s         


        

Answer 1

What is probably done here is that this client has changed the PHPSESSID cookie's content. Normally the SessionID is something like "62bf75fb02922cf9c83fb3521255b4ab" (hexadecimal)

However, the user might have modified the cookie using some tools. This causes no harm to your website and server because this modification is done client side and by doing so it does not affect the server (except generating those errors). What you can do is that when you receive such error, you change the session ID and replace the one that is on the client.

See solution:

$ok = @session_start();
if(!$ok){
  session_regenerate_id(true); // replace the Session ID
  session_start(); // restart the session (since previous start failed)
}

Remember, you can't replace or write a file onto the server via PHP session cookie. It is only when a session is successfully started, PHP writes a Session file about the current session and stores it to the tmp folder. Once the file becomes old, the file is deleted.