Authentication and Session Security

# CHAPTER 3

Authentication and Session Security #

1. Introduction #

2. Learning Objectives #

• Define Authentication versus Authorization.

• Understand why plaintext password storage is catastrophic.

• Implement secure password hashing using modern algorithms (Bcrypt).

• Explain the concept of Session Hijacking.

• Implement secure session management practices in PHP.

3. Beginner-Friendly Explanation #

• Authentication: You walk up to the bouncer, show your ID, and give the secret password. The bouncer checks his list and verifies you are allowed in.

• The Vulnerability (Bad Passwords): If the password to the club is "123456", anyone can guess it and walk in.

• Session Management: Once inside, you don't want to show your ID every time you order a drink. So, the bouncer gives you a unique, unforgeable wristband (The Session ID).

• Session Hijacking: If a thief inside the club cuts the wristband off your arm and puts it on theirs, the bartender will think the thief is you and charge your tab.

4. The Golden Rule of Passwords: Hashing #

5. Multi-Factor Authentication (MFA) #

1. 1. Something you know: A password.

1. 2. Something you have: Your smartphone (an authenticator app generating a 6-digit code).

1. 3. Something you are: A fingerprint or FaceID.

6. Securing the Session #

• Session Hijacking: Stealing the cookie via a Cross-Site Scripting (XSS) attack.

• Session Fixation: The hacker tricks the user into using a specific Session ID that the hacker already knows.

• Regenerate the Session ID immediately *after* the user successfully logs in.

• Set the Cookie flags to Secure (HTTPS only) and HttpOnly (Invisible to JavaScript).

7. Mini Project: Build a Secure PHP Login Concept #

Step 1: Registration (Hashing the Password)

$password = $_POST['password'];
// NEVER use md5() or sha1() for passwords!
// password_hash automatically generates a secure random Salt and uses Bcrypt.
$hashed_password = password_hash($password, PASSWORD_BCRYPT);
// Save $hashed_password to the database

Step 2: Login & Session Management

$login_attempt = $_POST['password'];
// Fetch the $hashed_password from the database based on username
if (password_verify($login_attempt, $hashed_password)) {
    // Login successful!
    session_start();
    // CRITICAL: Prevent Session Fixation by regenerating the ID!
    session_regenerate_id(true); 
    $_SESSION['user_id'] = $user_id;
    echo "Welcome to the dashboard.";
} else {
    echo "Invalid credentials.";
}

8. Real-World Scenarios #

9. Best Practices #

• Generic Error Messages: When a user logs in incorrectly, never say "Password incorrect" or "Username not found." This tells an attacker whether a specific email address exists in your database (User Enumeration). Always use a generic message like: "Invalid username or password."

10. Legal and Ethical Notes #

11. Exercises #

1. 1. Explain why hashing passwords using Bcrypt is fundamentally more secure than encrypting passwords using AES-256.

1. 2. What is Session Fixation, and what specific PHP function neutralizes this threat during the login process?

12. FAQs #

13. Interview Questions #

• Q: Describe the authentication workflow for a secure web application, detailing the transition from verifying credentials to establishing a secure, stateful session.

• Q: A developer has implemented a session cookie but failed to set the HttpOnly flag. Detail the specific attack vector this exposes and how an attacker would exploit it to achieve account takeover.

14. Summary #

15. Next Chapter Recommendation #