Weak Session ID

Also Known As

TL;DR

Explanation

A weak session ID is one that is too short, uses a predictable algorithm (sequential numbers, MD5 of timestamp), or is derived from guessable input. Attackers can enumerate or predict valid session tokens to hijack authenticated sessions without needing credentials. PHP's default session ID generator is cryptographically secure when session.use_strict_mode is enabled and the session handler uses random_bytes() internally — avoid custom session ID generation unless you use random_bytes(32) or similar.

Common Misconception

Why It Matters

Common Mistakes

• Using a custom session ID generation function instead of PHP's session_regenerate_id().
• Short session IDs (less than 128 bits of entropy) that are feasible to enumerate.
• Not regenerating the session ID after login — allows session fixation attacks.
• Including user-supplied values (like user ID) in the session ID, reducing its unpredictability.

Avoid When

• Never generate session IDs manually using rand(), mt_rand(), uniqid(), or md5(time()).
• Do not transmit session IDs in URLs — always use HttpOnly, Secure cookies.

When To Use

• Use PHP's built-in session_start() with session.use_strict_mode=1 — it generates cryptographically secure session IDs automatically.
• Regenerate the session ID after login with session_regenerate_id(true) to prevent fixation attacks.

Code Examples

// Predictable session IDs
\$sessionId = md5(\$userId . time()); // time-based, guessable

// PHP's session_start() with secure config generates cryptographically
// random session IDs by default (uses /dev/urandom)
ini_set('session.entropy_length', 32);
ini_set('session.hash_function', 'sha256');
ini_set('session.hash_bits_per_character', 6);
// Result: 43+ char session ID from CSPRNG

// For API tokens — random bytes
\$token = bin2hex(random_bytes(32)); // 64 char hex token
\$stored = hash('sha256', \$token);   // store hash in DB, send raw to client

References

• ↗ https://owasp.org/www-community/attacks/Session_hijacking_attack
• ↗ https://www.php.net/manual/en/session.security.php

Tags

Related Terms