destroy session

[jackvull]

On my site, users have the ability to login securely via SSL. I reset the sessionid on each ne request for a page and I give them the ability to logout and destroy the session.

The problem is that that after loggin in, the user can request a non-secure page, i.e. the part of the site that doesn't need to be secure or require users to be logged in. The problem with this is that the sessionID will no longer be secured by SSL and it will not be changed on every page so a hacker could potentially get hold of the session and log in themselves.

Is there a way round this, or to somehow require the user to logout when leaving the secure site...or automatically destroying the session when leaving the secure site?

[jatar_k]

you could use an auth routine for your non secured site that checks for the existence of the session and destroys it.

though that may not work as essentially they are different sites

[jackvull]

The problem is that I run sessions on my insecure site as well to keep state between the pages, i.e. there are dynamic links that I want kept for the same visitor until they close the browser.

Would it be acceotable to keep changing the session id on the insecure site as well? That way if some moves, after having logged in, from SSL to normal, the session id will keep changing and the old one used to login will no longer be valid?

[jatar_k]

the thing I don't really understand is why you constantly change the id

you should be able to set up your authentication to not allow session hijacking with out having to swap session ids all the time. Maybe you need to add more criteria to your session such as a time out and maybe even the user's ip address

maybe take a look at this thread
[webmasterworld.com...]

[jackvull]

I read somewhere that it was best to keep changing the session ID on every page request for security against hacking even over a SSL connection. Is this not worth it?

I guess the alternative would just be to regenerate a session ID each time the user has to do something to authenticate themselves, e.g. log in, reset password, etc.

There's also some stuff written about AOL changing the user's IP address on every request and multiple computers hiding behind a single IP address (corporate gateway) so that might rule out the IP check?