PHP’s support for sessions make adding "state" to your web application super easy. Bus because the illusion of state is maintained by storing a Session ID via a user’s cookies, you might find yourself losing potentially productive hours chasing down bizarre client side bugs or opening up a potential security hole. Here are 4 tips to help you avoid wasting your time and securing your site.
1. Don’t use underscores in host names
Unless you’ve memorized the RFC for allowed characters in a host name, you may not be aware that underscores are not allowed in host names. Some browsers, like Firefox, don’t enforce this prohibition, but Internet Explorer enforces it and will refuse to set a cookie belonging to a host name with an underscore in it. IE will instead cause php to generate a new session id for the visitor on each page load, since, the user never accepts a session id. Source: set_cookie documentation.
2. Commit your sessions before redirects
You should call session_write_close (or its alias session_commit) to write session data before issuing an HTTP Location redirects. This also "frees" the user’s session so that they can do other activities in your web app. See the comments by cenaculo and bkatz.
3. Prevent session fixation
Session fixation allows an attacker to get a valid session id without predicting it or reading it from a user’s cookies or $_GET array. Instead, a victim ends up using a session id generated by the attacker not your web server. You can prevent this by calling session_regenerate_id(), particularly after storing sensitive information such as a login name or flag. This should render the attacker’s defined sessin id useless. Chris Shifflet has a more thorough discussion of Session Fixation.
4. Don’t expose session_id’s
Cookies are, relatively, a more secure place to store your session ids compared to embedding them as a parameter in the query string. There are two ini setting to control this behavior, and which one is appropriate is hard to tell, so you should set them both. You should set session.use_trans_sid to 0 (off) and if you’re using 4.3.0 or higher you can set session.use_only_cookies to "1".