PHP Sessions - No session_regenerate_id Opens Hijack

<?php
// ─────────────────────────────────────────────────────────────
// cookie_preference.php
// Demonstrates setting, reading, and deleting a cookie that
// stores the user's preferred UI theme.
// ─────────────────────────────────────────────────────────────

$cookieName    = 'user_theme';       // The key we'll look for in $_COOKIE
$cookieValue   = 'dark';            // The preference we're saving
$cookieExpiry  = time() + (86400 * 30); // 30 days from right now
$cookiePath    = '/';               // Available across the whole site
$cookieDomain  = '';                // Empty = current domain only
$secureCookie  = false;             // Set TRUE in production (HTTPS only)
$httpOnlyCookie = true;             // JS cannot read this cookie — safer

// setcookie() MUST come before any echo/HTML output
setcookie(
    $cookieName,
    $cookieValue,
    [
        'expires'  => $cookieExpiry,
        'path'     => $cookiePath,
        'domain'   => $cookieDomain,
        'secure'   => $secureCookie,
        'httponly' => $httpOnlyCookie,
        'samesite' => 'Lax'          // Protects against CSRF cookie theft
    ]
);

// ── Reading the cookie on the NEXT request ──────────────────
// $_COOKIE is populated from the browser's cookie jar.
// On THIS request the cookie isn't in $_COOKIE yet —
// the browser only sends it back on the NEXT request.

if (isset($_COOKIE[$cookieName])) {
    $savedTheme = htmlspecialchars($_COOKIE[$cookieName]); // Always sanitise!
    echo "Welcome back! Your saved theme is: " . $savedTheme . "\n";
} else {
    echo "No theme preference found — using default light theme.\n";
}

// ── Deleting a cookie ───────────────────────────────────────
// You can't 'delete' a cookie directly — you overwrite it
// with an expiry time in the past.
setcookie($cookieName, '', [
    'expires'  => time() - 3600,  // 1 hour in the past = instant deletion
    'path'     => '/',
    'httponly' => true,
    'samesite' => 'Lax'
]);

echo "Cookie scheduled for deletion.\n";
?>

<?php
// ─────────────────────────────────────────────────────────────
// session_login.php
// A realistic login + session workflow.
// In production you'd query a database; here we use a hardcoded
// user to keep the focus on session mechanics.
// ─────────────────────────────────────────────────────────────

session_start(); // MUST be the first thing — before any output

// ── Simulated user database ──────────────────────────────────
$registeredUsers = [
    'alice@example.com' => [
        'password_hash' => password_hash('s3cureP@ss', PASSWORD_BCRYPT),
        'display_name'  => 'Alice Ng',
        'role'          => 'editor'
    ]
];

// ── Handle login form submission ─────────────────────────────
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $submittedEmail    = trim($_POST['email'] ?? '');
    $submittedPassword = $_POST['password'] ?? '';

    if (
        isset($registeredUsers[$submittedEmail]) &&
        password_verify($submittedPassword, $registeredUsers[$submittedEmail]['password_hash'])
    ) {
        // Credentials are valid — regenerate session ID BEFORE writing data.
        // This prevents session fixation attacks.
        session_regenerate_id(true);

        // Store only what you need — not the whole user record
        $_SESSION['user_email']        = $submittedEmail;
        $_SESSION['user_display_name'] = $registeredUsers[$submittedEmail]['display_name'];
        $_SESSION['user_role']         = $registeredUsers[$submittedEmail]['role'];
        $_SESSION['logged_in_at']      = time(); // Track session age

        echo "Login successful. Hello, " . htmlspecialchars($_SESSION['user_display_name']) . "!\n";
    } else {
        echo "Invalid email or password.\n";
    }
}

// ── Checking if a user is already logged in ──────────────────
function isUserLoggedIn(): bool {
    // Check the flag AND enforce a session timeout of 30 minutes
    $sessionTimeoutSeconds = 1800;

    if (!isset($_SESSION['user_email'], $_SESSION['logged_in_at'])) {
        return false;
    }

    if ((time() - $_SESSION['logged_in_at']) > $sessionTimeoutSeconds) {
        session_unset();   // Clear session data
        session_destroy(); // Delete the session file on disk
        return false;
    }

    // Refresh the activity timestamp so active users don't get booted
    $_SESSION['logged_in_at'] = time();
    return true;
}

if (isUserLoggedIn()) {
    echo "Welcome back, " . htmlspecialchars($_SESSION['user_display_name']) . "!\n";
    echo "Your role is: " . htmlspecialchars($_SESSION['user_role']) . "\n";
}

// ── Logging out ──────────────────────────────────────────────
function logoutUser(): void {
    session_start(); // Must start before destroying

    // Wipe all session variables first
    $_SESSION = [];

    // Expire the session cookie in the browser
    if (ini_get('session.use_cookies')) {
        $cookieParams = session_get_cookie_params();
        setcookie(
            session_name(),           // Usually 'PHPSESSID'
            '',
            time() - 42000,
            $cookieParams['path'],
            $cookieParams['domain'],
            $cookieParams['secure'],
            $cookieParams['httponly']
        );
    }

    session_destroy(); // Remove the server-side session file
    echo "You have been logged out.\n";
}
?>

<?php
// ─────────────────────────────────────────────────────────────
// remember_me_token.php
// Implements a secure 'Remember Me' flow.
// This is the pattern used by Laravel, Symfony, and most
// serious PHP frameworks under the hood.
// ─────────────────────────────────────────────────────────────

define('REMEMBER_ME_COOKIE', 'remember_token');
define('REMEMBER_ME_DAYS',   30);

/**
 * Called at login when the user ticks 'Remember me'.
 * $userId — the authenticated user's database ID
 */
function issueRememberMeToken(int $userId, PDO $db): void {
    // Generate a cryptographically secure random token
    $rawToken    = bin2hex(random_bytes(32)); // 64-char hex string
    $hashedToken = hash('sha256', $rawToken); // Never store raw tokens
    $expiresAt   = date('Y-m-d H:i:s', time() + (86400 * REMEMBER_ME_DAYS));

    // Persist the hashed token in the database
    $statement = $db->prepare(
        'INSERT INTO remember_me_tokens (user_id, token_hash, expires_at)
         VALUES (:user_id, :token_hash, :expires_at)'
    );
    $statement->execute([
        ':user_id'    => $userId,
        ':token_hash' => $hashedToken,
        ':expires_at' => $expiresAt
    ]);

    // Store only the RAW token in the cookie — the hash stays on the server
    setcookie(REMEMBER_ME_COOKIE, $rawToken, [
        'expires'  => time() + (86400 * REMEMBER_ME_DAYS),
        'path'     => '/',
        'secure'   => true,   // HTTPS only in production
        'httponly' => true,   // Not accessible via JavaScript
        'samesite' => 'Lax'
    ]);

    echo "Remember-me token issued. Cookie will last " . REMEMBER_ME_DAYS . " days.\n";
}

/**
 * Called on each page load to silently log in a returning user.
 * Returns the user_id if the token is valid, or null if not.
 */
function resolveRememberMeToken(PDO $db): ?int {
    if (!isset($_COOKIE[REMEMBER_ME_COOKIE])) {
        return null; // No cookie, nothing to do
    }

    $rawToken    = $_COOKIE[REMEMBER_ME_COOKIE];
    $hashedToken = hash('sha256', $rawToken); // Re-hash to look up in DB

    $statement = $db->prepare(
        'SELECT user_id FROM remember_me_tokens
         WHERE token_hash = :token_hash
           AND expires_at > NOW()'
    );
    $statement->execute([':token_hash' => $hashedToken]);
    $row = $statement->fetch(PDO::FETCH_ASSOC);

    if (!$row) {
        // Token not found or expired — clear the stale cookie
        setcookie(REMEMBER_ME_COOKIE, '', ['expires' => time() - 3600, 'path' => '/']);
        return null;
    }

    // Token is valid — start a fresh session for this user
    session_start();
    session_regenerate_id(true);
    $_SESSION['user_id']   = (int) $row['user_id'];
    $_SESSION['logged_in_at'] = time();

    echo "Silent login successful for user ID: " . $row['user_id'] . "\n";
    return (int) $row['user_id'];
}

// ── Usage example (assuming $pdo is a connected PDO instance) ─
// issueRememberMeToken(42, $pdo);
// $userId = resolveRememberMeToken($pdo);
?>

<?php
// ─────────────────────────────────────────────────────────────
// session_hardening.php
// Apply these settings early, before session_start()
// ─────────────────────────────────────────────────────────────

// Force cookies-only sessions (no URL propagation)
ini_set('session.use_only_cookies', 1);

// Prevent session ID from being passed via URL
ini_set('session.use_trans_sid', 0);

// Set session cookie parameters
session_set_cookie_params([
    'lifetime' => 0,            // Until browser closes
    'path'     => '/',
    'domain'   => '',
    'secure'   => true,         // Only over HTTPS
    'httponly' => true,         // JS cannot access
    'samesite' => 'Lax'         // CSRF protection
]);

// Optional: bind session to user agent
if (isset($_SESSION['user_agent_hash'])) {
    $currentHash = md5($_SERVER['HTTP_USER_AGENT'] ?? '');
    if ($_SESSION['user_agent_hash'] !== $currentHash) {
        session_destroy();
        echo "Session hijacking detected. Redirecting to login.\n";
        exit;
    }
} else {
    $_SESSION['user_agent_hash'] = md5($_SERVER['HTTP_USER_AGENT'] ?? '');
}

// Optional: set a custom entropy for better session IDs
ini_set('session.entropy_file', '/dev/urandom');
ini_set('session.entropy_length', 32);

session_start(); // Now safe to start
?>

<?php
// ─────────────────────────────────────────────────────────────
// redis_session_handler.php
// Configure PHP to use Redis for session storage.
// ─────────────────────────────────────────────────────────────

// Option 1: Use the native redis extension (recommended)
// Install: pecl install redis
ini_set('session.save_handler', 'redis');
ini_set('session.save_path', 'tcp://127.0.0.1:6379?prefix=PHPSESSIONS:');

// Option 2: If you can't install the extension, use predis via custom handler
// (Simplified — in production, use a robust handler library)

session_start();

// Now all session data is stored in Redis, shared across all servers
$_SESSION['user_id'] = 42;
echo "Session stored in Redis.\n";
?>

// ── php.ini equivalent ───────────────────────────────────────
// session.save_handler = redis
// session.save_path = "tcp://127.0.0.1:6379?auth=mypassword&prefix=PHPSESSIONS:"

// io.thecodeforge — php tutorial

$user_id = 2047;
$token = bin2hex(random_bytes(16));
$expires = time() + 86400 * 30; // 30 days

setcookie(
    'session_token',
    $token,
    $expires,
    '/',
    'shop.example.com',
    true,   // secure — HTTPS only
    true    // httponly — JS can't touch it
);

echo "Cookie set for user $user_id";

// io.thecodeforge — php tutorial

// Retrieve the cookie securely
if (isset($_COOKIE['session_token'])) {
    $stored_token = $_COOKIE['session_token'];
    echo "Found token: " . substr($stored_token, 0, 8) . "...\n";
} else {
    echo "No session token cookie found.\n";
}

// Delete the cookie
setcookie(
    'session_token',
    '',
    time() - 3600,  // expired 1 hour ago
    '/',
    'shop.example.com',
    true,
    true
);
echo "Cookie 'session_token' deleted.";

// io.thecodeforge — php tutorial

session_start();

// Store session data
$_SESSION['user_id'] = 2047;
$_SESSION['cart_total'] = 49.99;

echo "Session started. User ID: " . $_SESSION['user_id'] . "\n";

// Later, on logout:
session_unset();     // clear all vars
session_destroy();   // kill session file on server
setcookie('PHPSESSID', '', time() - 3600, '/');
echo "Session destroyed.";