session_start(); time-out + security OK?

I want a bigger time-out... + security OK?

[fmaz]

I'm a webmaster of an online game.

I base all the users login on the php session...

My main problem:
After like 1 hour of innactivity, the session expire and the played logged in is disconnected. I would like to raise the time-out to .. let say 3 hours ...

Is it possible? How?

-------------------------------
a)Many people create their own session, why? is the php session are "unsecure"?

b) Is it possible to "change" the value of a session variable .. I mean, is an hacker can change let say:

$_session["user"] = "wrong user";
to
$_session["user"] = "good user";

(that could be $_session["accesslevel"] or anything else..)

Because the way my login work is a little bit like this:

-User enter login info;
-Login info checked with the DB;
-If user/pass match, then:
$_session["user"] = $_post["user"];
else
$_session["user"] = "";

on the page security, I do this kind of check:
if (!isset($_SESSION["user"]) ¦¦ (isset($_SESSION["user"]) && $_SESSION["user"] == "") {
die("<script>location='login.php';</script>";
}

Is this way is secure?
If no, how can I secure it?

[coopster]

It's more than likely the session garbage collection that you'll want to address. A recent thread asked Session is timing out - how do I increase cookie time? [webmasterworld.com] Some other areas to check are in this thread regarding PHP Session ID - randomonly resets [webmasterworld.com].

And the security stuff...a good start is the PHP manual pages on Session Handling [php.net] and Security [php.net].

[fmaz]

Ok, they said it is not secur, but how are you doing secur login then?

Hum, seem to have no way to increment the timeout of a session (if I don't have access to the .ini)

[coopster]

A truly secure login will use SSL. You then use session management to pass a session id back and forth, the whole time leaving all other information in a file on the server, including the userid, password, etc.

Yes, you should have control over your sessions. Read the first linked thread again. The link provided states that you can override every session configuration directive except one, and you don't have to do it in the

php.ini

file.

[fmaz]

Ho, sorry, I'll take a second look

Thank's for your help, it's appreciated

[coopster]

Quite alright. Sessions and security can be a bit overwhelming at first, not to mention intimidating. But you have to start somewhere and having a good forum to ask questions when you are stuck is priceless.

[fmaz]

:) hehe :)

I've tried to put this:
(this is in my header.php file, included on the top of every page of the site, user logged or not.)

<?php
include "_colors.inc.php";
@ini_set("session.gc_maxlifetime","3600");
session_start(); //Démarrer le cookies session.
?>

_colors.inc.php only set variable...

Seem ok?

[coopster]

I used to think so once, until I employed the same theory on a shared server. I recommend setting the

session.save_path

configuration directive as well as mentioned in msg #5 of the "Session is timing out - how do I increase cookie time?" link above.