PHP - 会话不匹配，不同的id和错误的用户，劫持风险和主要的安全风险

Question

Found a major problem on my website. I found tha if I login with user A. it sometimes kinda does log in but actually doesn't. Then I login with user B -> enter the site. I log out and then go manually back to url where login is needed and it somehow goes in with user A. It seems that I have two (maybe could have more) session_id cookies on different tabs or there is a ghost session_id that comes active I don't know. Pulling my hairs here.

Also found that, lets say I have a user dashboard and test page. With a little going back and forth with different credentials. I get this result: Dashboard echoes user A's id, test echoes user B's id or not id at all. What the heck I am doing wrong with my sessions? Login is done with AJAX. Login validation is the same on every page.

COMMON FUNCTIONS:

    function validateUser($userid) {
    session_regenerate_id();
    $_SESSION['valid'] = 1;
    $_SESSION['usersid'] = $userid;
}

function isLoggedIn() {
    if (isset($_SESSION['valid']) && $_SESSION['valid'] == 1) {
        return true;
    } else {
        return false;
    }
}

function logout() {
    $_SESSION = array();
    session_unset();
    session_destroy();
}

LOGIN/DB: Login page:

    session_start();
include 'include_files.php';

if(isLoggedIn()){
    header('Location:loginrequiredpage.php');
    die();
}

Login page sends username/password with AJAX to an controller php file that uses db functions as included file. It executes usercheckfunc() which checks user from db and then echoes succes or fail back to ajax.

from db functions - part of user check function

//if user found from db and password hash match
validateUser(**ID FROM DATABASE**);

Back in login page if ajax gets success message back, JS send user to login required url. Here's where mystery sometimes occur The browser acts like if i just logged in somewhere, but the login page is loaded again. Sometimes I can manually go to login required page via address bar. Sometimes if I logout/idle too long etc. and login with different username/password I get in as a wrong user. Entered as user A, See user B's data OR echo different userids on pages or echo id only on other page.

LOGIN REQUIRED PAGE:

    <?php
    session_start();
    require_once 'include_files.php';
    if (!isLoggedIn()) {
        logout();
        header('Location:login.php');
        die();
    }

echo $_SESSION['usersid'];

Test page:

    <?php
    session_start();
    error_reporting(E_ALL);
    ini_set('display_errors', 1);

    require_once 'include_files.php';
    if (!isLoggedIn()) {
        logout();
        header('Location:login.php');
        die();
    }
echo $_SESSION['usersid'];

Is there a "best" way to manage sessions? Help is much appreciated :)

Answer 1

Got rid of the problem by manually setting session cookie parameters everywhere before session_start is executed. Now the session cookie domain doesn't behave unexpectedly. Sorry, no idea why it did that mysterious changeing before.

This cookie parameters sets it to be valid on whole domain. I guess it's no good in situation where you need different sessions on the same domain (different applications etc.). But for me it was the healing patch I needed.

session_set_cookie_params(0, '/', '.example.com');
session_start();