How important is it to use a token for sessions? And lets say specifically with php.

abefroman · 11-22-2009, 10:12 PM

How important is it to use a token for sessions?

It looks like php automatically creates a token for the session in the form of a cookie:
PHPSESSID

Is that typically sufficient for maintaining session security?

Or should I hardcode a token generator into my php script as well?

TIA

kbp · 11-23-2009, 01:17 AM

OWASP are pretty much the definitive source for web app security questions -
http://www.owasp.org/index.php/Session_Management

cheers

abefroman · 11-23-2009, 09:38 PM

Quote:

Originally Posted by kbp

OWASP are pretty much the definitive source for web app security questions -
http://www.owasp.org/index.php/Session_Management

cheers

Looks like for the most part, its saying the PHP sessions are fine. Except for the timeout value, which is doesn't specify what php uses by default or how to set/change it.