How to prevent Session and Cookie Hacking?

[Sonal Tandlekar]

#53271

How to prevent Session and Cookie Hacking?

---

[darshan.soni007]

#53273

Hello Sonal,

The session and cookie hacking can’t breach the database or the web application, but it can yield user accounts. A session is an entity triggered when users begin contact with a web server and consists of a period of communication between users and web application which is authenticated using security measures like a username and password.

 

Steps to prevent hacking:

-In order to prevent hackers from setting session ID’s prior to login, ID’s should be changed often, therefore, the session_regenerate_id() function should be used every time the user logs in, assigning them a fresh ID.

-The risk of this hacking can be mitigated by revalidating a user who is about to perform sensitive tasks like resetting their password (i.e. by making them re-enter their old password).

-If the user’s password is to be stored in a session variable, it needs to be encrypted (using the sha1() function).

-If your web application is handling sensitive information like debit and credit card numbers, then practicing an SSL or any other secured connection can also prevent session and cookie hacking

---

[Author]

Posts