Custom 'secure' php and MySQL user login session system

Question

In the past we were using passwords stored in md5 and then the $userId_$md5password in cookies to validate a user logged in ... this was extremely poor security so it was time to change it.

The system is a VPS so I don't think anyone else can get access to session variables, the database or filesystem. Login and registration pages make use of ssl to submit data.

Upon registration user passwords are now crypted in this manner before being sent to the database:

$salt = to64(getRandomBytes(16));

if (CRYPT_BLOWFISH == 1) 
    $securePassword = crypt($password, '$2a$10$'.$salt);

Sessions are now used instead of plaintext cookie authorization and the php.ini file includes:

session.use_trans_sid = 0
session.use_only_cookies = 1
session.hash_function = sha512
session.hash_bits_per_character = 5

Sessions are started and configured like this ensuring no secure data is kept within a session:

session_set_cookie_params("86400", "/");
session_name("auth");
session_start();

$_SESSION['userId'] = $row[0];
$_SESSION['created'] = time();

Session id's are regenerated every 30 minutes so the system is kept rotating:

if($_SESSION['created'] + 30 * 60 < time())
{
    session_regenerate_id ();
    $_SESSION['created'] = time();
}

Sessions are set to expire after 24 hours if a user doesn't use the site again within this time, is this too long an amount of time?

We may also add ip/http user agent checks to the sessions but at the moment I think it's okay as the id can't be faked?

Have I missed out any glaring security holes?

I'll also point out that this system will work alongside openid and our servers won't be storing details such as credit cards just emails, usernames and bio information, not that that makes a difference in data protection.

Answer 1

You wrote "Login and registration pages make use of ssl", does that mean that you switch back to HTTP for the other pages? In this case, the session cookie would be sent plaintext for this other pages (or even for an image request).

You can make sure, that the session cookie is sent only to HTTPS pages, but you will lose the session for HTTP pages:

session_set_cookie_params('86400', '/', '', true, true);

Note the first true, it means that the cookie will be sent only to HTTPS pages. The second true tells the browser, that JavaScript must not access the session cookie (it depends on the browser if that is done correctly).

I would suggest one of these solutions:

1. Use HTTPS for the whole site, this is the easiest and safest way.
2. Separate the two concerns, maintaining the session, and authentication. This article shows how you can safely switch between HTTP and HTTPS.