All research
Advisory4 min read
Session identifiers that survive login in custom PHP auth flows
A recurring pattern in hand-rolled authentication: privileges change, the session ID does not.
By Opsec Research
Framework authentication components rotate the session identifier when a user signs in. Custom login handlers frequently do not, which lets an attacker who can set a victim’s session ID ride the authenticated session afterwards.
The fix is one call to session_regenerate_id(true) at the moment privileges change. Opsec flags the pattern only when the replica confirms that a pre-set identifier remains valid after login.