Session Hijacking Prevention Script

A Session Hijacking Prevention Script helps protect web applications by detecting and blocking unauthorized access to user sessions. It monitors session integrity, validates user IP addresses and user-agents, and regenerates session IDs periodically to minimize the risk of session theft. By enforcing secure cookies, HTTPS, and inactivity timeouts, it ensures that attackers cannot impersonate legitimate users or gain access to sensitive data.

<?php
session_start();

// Force HTTPS
if(empty($_SERVER['HTTPS']) || $_SERVER['HTTPS'] === "off"){
    header("Location: https://" . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
    exit();
}

// Regenerate session ID periodically
if(!isset($_SESSION['created'])) {
    $_SESSION['created'] = time();
} elseif(time() - $_SESSION['created'] > 300) { // 5 minutes
    session_regenerate_id(true);
    $_SESSION['created'] = time();
}

// Bind session to IP and User-Agent
$ip = $_SERVER['REMOTE_ADDR'];
$ua = $_SERVER['HTTP_USER_AGENT'];
if(!isset($_SESSION['IP'])) $_SESSION['IP'] = $ip;
if(!isset($_SESSION['UA'])) $_SESSION['UA'] = $ua;
if($_SESSION['IP'] !== $ip || $_SESSION['UA'] !== $ua){
    session_destroy();
    exit("Session hijacking attempt detected!");
}
?>

Secure Session Initialization

A robust prevention script starts by securely initializing sessions using unique, unpredictable session IDs. It ensures that session cookies are flagged as HttpOnly and Secure, preventing access through client-side scripts or unsecured connections. Regenerating session IDs on login and critical actions reduces the risk of session fixation attacks. Proper session initialization sets the foundation for safe user interactions. This step is essential for protecting sensitive information from hijackers.

IP & User-Agent Validation

The script can track the originating IP address and browser User-Agent of each session. Any sudden changes trigger alerts or force re-authentication, preventing attackers from using stolen session IDs from different environments. This layer of validation adds contextual security beyond just the session ID. It ensures that sessions remain bound to the legitimate user. Continuous validation reduces unauthorized access risks significantly.

Session Timeout & Inactivity Handling

Automatically expiring sessions after a defined period of inactivity limits the window for hijacking attempts. Users are logged out after inactivity, and session data is securely destroyed on the server side. Shorter timeout durations can be configured for sensitive operations. This approach minimizes exposure of active sessions to potential attackers. It balances security and user convenience efficiently.

Regeneration of Session IDs

Periodically regenerating session IDs during a session reduces the risk of session fixation and replay attacks. This ensures that even if an attacker captures a session ID, it becomes invalid after regeneration. Regeneration is especially important after login, privilege escalation, or sensitive transactions. It strengthens session security dynamically. Combined with secure cookies, it significantly hardens the session against hijacking attempts.

Encrypted Session Storage

Storing session data in encrypted form on the server adds an additional layer of protection. Even if attackers gain access to server storage, encrypted sessions cannot be easily used to hijack accounts. Using secure algorithms and proper key management ensures confidentiality and integrity. Encrypted storage also supports compliance with security standards and regulations. This feature enhances the overall security posture against sophisticated threats.