PHP-Secure-Session

https://github.com/ezimuel/php-secure-session
Admin
This project adds an encryption layer to internal PHP session save handlers using OpenSSL with...
Tokens:3,342
Snippets:26
Trust Score:9.3
License:MIT
Update:10 months ago
Show doc for...
Tokens:
Raw
### Complete PHP Secure Session Integration Example

Source: https://context7.com/ezimuel/php-secure-session/llms.txt

This comprehensive example illustrates a full integration of the PHP Secure Session library. It covers initialization, custom session handler configuration, storing and retrieving various sensitive data types, with encryption operating transparently. It requires 'vendor/autoload.php'.

```php
<?php
require_once 'vendor/autoload.php';

// Configure custom session settingsini_set('session.save_handler', 'files');ini_set('session.gc_maxlifetime', 3600);ini_set('session.cookie_lifetime', 0);ini_set('session.cookie_httponly', 1);ini_set('session.cookie_secure', 1);ini_set('session.use_strict_mode', 1);

session_save_path(sys_get_temp_dir());
session_start();

// Store various types of sensitive data
if (!isset($_SESSION['initialized'])) {
    $_SESSION['initialized'] = true;
    $_SESSION['timestamp'] = time();
    $_SESSION['user'] = [
        'id' => 1001,
        'username' => 'secure_user',
        'email' => 'user@example.com',
        'is_authenticated' => true
    ];
    $_SESSION['oauth_tokens'] = [
        'access_token' => 'ya29.a0AfH6SMBx...',
        'refresh_token' => '1//0gHZPj-x...',
        'expires_at' => time() + 3600
    ];
    $_SESSION['api_keys'] = [
        'stripe' => 'sk_live_51Abc...',
        'aws' => 'AKIAIOSFODNN7EXAMPLE'
    ];

    echo "New session created and encrypted\n";
} else {
    echo "Existing session loaded and decrypted\n";
    echo "Session age: " . (time() - $_SESSION['timestamp']) . " seconds\n";
}

echo "User: " . $_SESSION['user']['username'] . "\n";
echo "OAuth token expires in: " . ($_SESSION['oauth_tokens']['expires_at'] - time()) . " seconds\n";
echo "All sensitive data encrypted at rest\n";

session_write_close();
?>

```

--------------------------------

### Encrypt Session Data with Memcached Handler in PHP

Source: https://context7.com/ezimuel/php-secure-session/llms.txt

This example shows how to configure PHP sessions to use Memcached as a storage backend with PHP-Secure-Session. The library encrypts the session data before it is sent to the Memcached server and decrypts it transparently when read. Ensure Memcached is installed and running, and the 'memcached' PHP extension is enabled.

```php
<?php
require_once 'vendor/autoload.php';

// Configure session to use memcached
ini_set('session.save_handler', 'memcached');
ini_set('session.save_path', 'localhost:11211');

session_start();

// Store encrypted data in memcached
$_SESSION['cache_key'] = 'user_123_profile';
$_SESSION['cached_data'] = [
    'profile' => ['name' => 'John', 'age' => 30],
    'settings' => ['theme' => 'dark', 'lang' => 'en']
];

echo "Session data encrypted before storage in Memcached\n";
echo "Session ID: " . session_id() . "\n";
echo "Data is encrypted in Memcached, decrypted transparently on read\n";

session_write_close();
?>
```

--------------------------------

### Manage Session Encryption Keys

Source: https://context7.com/ezimuel/php-secure-session/llms.txt

This example shows how to manage session encryption keys. Keys are generated securely and stored in cookies with a 'KEY_' prefix. The snippet also configures session cookie parameters like lifetime, path, and security flags. It requires 'vendor/autoload.php'.

```php
<?php
require_once 'vendor/autoload.php';

// Configure session cookie parameters before starting
session_set_cookie_params([
    'lifetime' => 3600,
    'path' => '/',
    'domain' => '',
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Strict'
]);

session_start();
$sessionName = session_name();
$keyName = 'KEY_' . $sessionName;

$_SESSION['sensitive_data'] = 'Top secret information';

// Check if encryption key cookie exists
if (isset($_COOKIE[$keyName])) {
    echo "Encryption key cookie: " . $keyName . "\n";
    echo "Key length (Base64): " . strlen($_COOKIE[$keyName]) . " chars\n";
    echo "Key length (decoded): " . strlen(base64_decode($_COOKIE[$keyName])) . " bytes\n";
} else {
    echo "New encryption key generated\n";
}

session_write_close();
?>

```

--------------------------------

### Initialize Secure Session Handler in PHP

Source: https://context7.com/ezimuel/php-secure-session/llms.txt

Initializes the SecureHandler, which extends PHP's SessionHandler with encryption. It checks for required OpenSSL and mbstring extensions. This snippet demonstrates setting the custom handler and starting a session.

```php
<?php
require_once 'vendor/autoload.php';

try {
    $handler = new \PHPSecureSession\SecureHandler();
    session_set_save_handler($handler, true);
    session_start();

    echo "Secure session handler initialized successfully";
} catch (\RuntimeException $e) {
    die("Failed to initialize: " . $e->getMessage());
}
?>
```

--------------------------------

### Automatic Session Registration via Composer Autoload in PHP

Source: https://context7.com/ezimuel/php-secure-session/llms.txt

Demonstrates automatic registration of the secure session handler by simply including Composer's autoload file. This method requires no manual configuration changes to existing applications. It shows storing and accessing session data securely.

```php
<?php
// Automatic registration - just require Composer autoload
require_once 'vendor/autoload.php';

// Session handler is already registered, just start the session
session_start();

// Store encrypted data
$_SESSION['user_id'] = 12345;
$_SESSION['username'] = 'john_doe';
$_SESSION['email'] = 'john@example.com';

echo "Session ID: " . session_id() . "\n";
echo "Session data stored securely\n";

session_write_close();
?>
```

--------------------------------

### Encrypted Session Storage to File in PHP

Source: https://context7.com/ezimuel/php-secure-session/llms.txt

Shows how session data is transparently encrypted and stored to disk using the default file handler. It includes random IV generation and HMAC authentication for security. The output displays the plain session data, the Base64 encoded encrypted file content, and the file size.

```php
<?php
require_once 'vendor/autoload.php';

ini_set('session.save_handler', 'files');
session_save_path(sys_get_temp_dir());
session_start();

// Store sensitive data
$_SESSION['credit_card'] = '4111-1111-1111-1111';
$_SESSION['ssn'] = '123-45-6789';
$_SESSION['account_balance'] = 10000.50;

$sessionId = session_id();
$sessionFile = sys_get_temp_dir() . '/sess_' . $sessionId;

echo "Plain session data: " . session_encode() . "\n";
echo "Encrypted file content (Base64): " . base64_encode(file_get_contents($sessionFile)) . "\n";
echo "File size: " . filesize($sessionFile) . " bytes\n";

session_write_close();
?>
```

--------------------------------

### Write Encrypted Session Data

Source: https://context7.com/ezimuel/php-secure-session/llms.txt

This snippet demonstrates writing complex data structures to an encrypted session. The library encrypts data with a fresh IV and authenticates it using HMAC for confidentiality and integrity. It requires the 'vendor/autoload.php' file.

```php
<?php
require_once 'vendor/autoload.php';

session_start();

// Write multiple types of data
$_SESSION['user_data'] = [
    'id' => 42,
    'username' => 'alice',
    'roles' => ['admin', 'editor'],
    'permissions' => ['read', 'write', 'delete']
];

$_SESSION['shopping_cart'] = [
    ['product_id' => 101, 'quantity' => 2, 'price' => 29.99],
    ['product_id' => 205, 'quantity' => 1, 'price' => 149.99]
];

$_SESSION['preferences'] = [
    'theme' => 'dark',
    'language' => 'en_US',
    'notifications' => true
];

echo "Complex data structures encrypted successfully\n";
echo "Session size: " . strlen(serialize($_SESSION)) . " bytes\n";

session_write_close();
?>
```

--------------------------------

### Read and Decrypt Session Data in PHP

Source: https://context7.com/ezimuel/php-secure-session/llms.txt

Illustrates the read() method's capability to automatically decrypt session data upon retrieval. It first validates the HMAC authentication to detect tampering. If authentication fails, an AuthenticationFailedException is thrown to prevent the use of corrupted data.

```php
<?php
require_once 'vendor/autoload.php';

session_start();

// First request - write data
if (!isset($_SESSION['visit_count'])) {
    $_SESSION['visit_count'] = 1;
    $_SESSION['first_visit'] = date('Y-m-d H:i:s');
    echo "First visit - data encrypted and stored\n";
} else {
    // Subsequent request - read decrypted data
    $_SESSION['visit_count']++;
    echo "Visit count: " . $_SESSION['visit_count'] . "\n";
    echo "First visit: " . $_SESSION['first_visit'] . "\n";
}

echo "Session data successfully decrypted and read\n";
session_write_close();
?>
```

--------------------------------

### Handle Authentication Failures in PHP Session

Source: https://context7.com/ezimuel/php-secure-session/llms.txt

This snippet demonstrates how the library handles authentication failures. If session data is tampered with, HMAC validation fails during decryption, triggering an AuthenticationFailedException. This prevents the use of compromised data. It requires 'vendor/autoload.php' and the PHPSecureSessionExceptionAuthenticationFailedException namespace.

```php
<?php
require_once 'vendor/autoload.php';

use PHPSecureSession\Exception\AuthenticationFailedException;

session_start();
$sessionId = session_id();

$_SESSION['account_id'] = 9876;
session_write_close();

// Simulate tampering by modifying the encrypted session file
$sessionFile = sys_get_temp_dir() . '/sess_' . $sessionId;
$content = file_get_contents($sessionFile);
$tamperedContent = substr($content, 0, -10) . 'TAMPERED!!';
file_put_contents($sessionFile, $tamperedContent);

// Attempt to read tampered session
session_start();

try {
    $accountId = $_SESSION['account_id'];
    echo "Account ID: " . $accountId . "\n";
} catch (AuthenticationFailedException $e) {
    echo "Authentication failed: " . $e->getMessage() . "\n";
    echo "Session data has been tampered with - rejected\n";
    session_destroy();
}
?>

```
Tokens:
Raw