Is PHP Session more secure or SetCookie? - php

Question

What bit is more secure?
function login_customer($customer_details) {
//Set a cookie to login the customer
setcookie("Str_CUST_LOGIN", 1, time()+3600);
setcookie("Str_CUST_EMAIL", $customer_details['customers_email']);
setcookie("Str_CUST_ID", $customer_details['customers_id']);
//Update the cart
return true;
}
or is this below. The script uses IF ELSE statements. Nightmare application for old client.
function login_customer($customer_details) {
//Set a cookie to login the customer
$str_HA_CUST_LOGIN="1";
// the customer details var gets info from a mysql escape form
// so mysql /xss is stopped
$str_HA_CUST_EMAIL=$customer_details['customers_email'];
$str_HA_CUST_ID=$customer_details['customers_id'];
$_SESSION["loggedIn"]=$str_HA_CUST_LOGIN;
$_SESSION["userEmail"]=$str_HA_CUST_EMAIL;
$_SESSION["userID"]=$str_HA_CUST_ID;
return true;
}
I am trying to improve it and lock sessions down. Not done any Salt, MD5 based sessions strings yet as I was thinking of a database session - only issue here is MySQL is so overloaded we had to make a master and cluster load balancer on cloud servers. 200+ average orders per second on a quite day. So I want sessions??

Answer 1

Cookies can be easily forged and tampered by a client. So if an attacker knows what cookies the application expects, he/she can forge the cookies or alter the cookie values at his/her will.
In your case it would probably be possible to authenticate as a arbitrary customer solely on the basis of knowledge of the customer ID (and/or the e-mail address).
The problem with this is that you mix up identification (‘Who is the user?’) and authorization (‘Can he/she prove it’s really him/her?’). Because both an ID and an e-mail address are used for identification as they are both unique and some kind of public (i. e. not just known to you) and thus not qualified for authentication. So don’t use identification information for authentication as well.
Now if you think I’ll just put the password in a cookie as well that would fulfill the authentication aspect, don’t do that either. Because there are attacks where an attacker can read the contents of a cookie (e. g. Cross-Site Scripting) and thus would be able to obtain the authentication data.
Use the session container instead to store the sensible information on the server side. But with sessions you still need to be aware of session related attacks like Session Hijacking or Session Fixation.

Answer 2

Cookies and their data are sent over the wire on EVERY request to the page. If you're embedding site-critical data in the cookies, it will be trivial to mangle/steal that data while the page requests is "in flight".
Sessions, by comparison, store all data on the server. The only thing that goes between the client and the server is the session's ID token. Stealing the session token allows an attacker to assume the victim's identity, but then they don't gain any more abilities than the user had already.
e.g. If you're sending out a cookie has_super_user_powers=false, then don't be surprised when someone hacks the cookie to make it true instead. Saving that flag in the session makes it unchangeable by the remote user, as the value never leaves your server in the first place.

Answer 3

Both can be stolen, but the value of cookies can be read. Sessions can contain more information.
Both are equally as safe, but to properly use cookies you'll have to spend a little bit more time.
If you're just starting with session management, just use sessions.
-edit-
Actually, technically cookies are more secure than sessions are. Since sessions are based on cookies they can only be as secure as cookies are, and almost always less secure than that. However, unless you have a very good implementation, sessions will be safer for you.

Answer 4

Depends on what kind of information you store in those cookies. But Sessions in general are more secure than cookies. Since cookies reside on the clients machine, while sessions are on your server.
If your server is already overloaded, better not use a database based session. Either use file based sessions (default per PHP) or the data you want to store is irrelevant, feel free to use cookies instead.