Sessions of different systems on the same server

Question

Scenario (example)

I have 2 systems:

• Sistema Padaria
• Posto System

---

Details

• The database is separated, then each system with its users and passwords.
• There’s "common user" among the 2 (e.g.: joão.silva)

---

Problems

If I don’t wear one session_name() different for each system, if I am logged in with the "Joao.silva" in the bakery system, and enters the station system, it will enter directly, as if it had authenticated.

---

Doubts

• When to use the session_name()?
• When to use the session_id()?
• What else seguro?
• Something more important in this context?

---

PS.: I appreciate good links for study. Please avoid searching on Google without at least checking if the content is complete and currently used.

Answer 1

First let me explain the main, the sessions are global, if they are on the same server and domain then they can be accessed by different applications.

However it is possible to limit the folders that can access the session cookie by adjusting the session_set_cookie_params, something like:

 setcookie(time() + 3600, '/sistema_a/'); //Somente acessivel na pasta sistema_a
 session_start();

But of course this control is only in the cookie, it is still possible to get the values by changing if you use the same session_id.

Some details:

• session_name will only pick up the call session at the moment
• you can’t read two sessions at once, you can even do some maneuvers in the code but will not work as well or in such a practical way.
• session_regenerate_id does not guarantee a general security, but one place that really can be useful is against sequestration of sessions, which has nothing to do with your problem

How the session works?

When using session_start will be created a cookie will have you a random code that will refer to a file in the folder /tmp (or c:\caminho\para\o\php\temp or c:\window\temp in the case of Windows Server), that is, the data is in the back end, there is no way anyone can steal them unless you as a developer have done something very wrong, an explanation about data exposure in the back end:

• /a/99377/3635

---

But going back to your applications, if you are the creator of both or at least understand the structure of both of the sessions, what you can do is check if you are already logged in and try to import the data by passing them to the format of the desired, for example:

• System A, is with session_name called SYSTEM_A and the format of the session:

  array(
     'sys_a' => array(
           'idUser' => '<id do usuario>',
           'name' => '<nome do usuario>',
           'update' => <ultima requisição HTTP atualiza esta chave>
     )
  )
  

• System B, is with session_name called SISTEM_B and the format of the session:

  array(
     'sys_b' => array(
           'id' => '<id do usuario>',
           'user' => '<nome do usuario>',
           'lastactive' => <ultima requisição HTTP atualiza esta chave>
     )
  )
  

They’re similar, but they’re not the same, so assuming you’re logged in to system A and will open the system B, you could create a file and include on top of all called sync_from_sis_a.php, thus:

<?php

require_once 'sync_from_sis_a.php';

The content of sync_from_sis_a.php would be:

<?php
session_name('SYSTEM_A');
session_start();

//Verifica se NÃO esta logado no B e se ESTA logado no A
if (empty($_SESSION['sys_b']['id']) && isset($_SESSION['sys_a']['idUser'])) {
   $id = $_SESSION['sys_a']['idUser'];
   $nome = $_SESSION['sys_a']['name'];

   session_write_close(); //Finaliza o handle

   session_name('SYSTEM_B'); //Agora no sistema B
   session_start();

   //Copia os dados da sessão anterior para a sessão do sistema B
   $_SESSION['sys_b']['id'] = $id;
   $_SESSION['sys_b']['user'] = $nome;
   $_SESSION['sys_b']['lastactive'] = time();
}

If you are not logged in to system A then it will open system B normally asking for login.

The same should be done in system A, check if you are already logged in, so if you do not have to check if you are logged in to B, then create a file called sync_from_sis_b.php and include at the top of all system A, the file should be like this:

<?php
session_name('SYSTEM_B');
session_start();

//Verifica se NÃO esta logado no A e se ESTA logado no B
if (empty($_SESSION['sys_a']['idUser']) && isset($_SESSION['sys_b']['id'])) {
   $id = $_SESSION['sys_b']['id'];
   $nome = $_SESSION['sys_b']['user'];

   session_write_close(); //Finaliza o handle

   session_name('SYSTEM_A'); //Agora no sistema A
   session_start();

   //Copia os dados da sessão anterior para a sessão do sistema B
   $_SESSION['sys_a']['idUser'] = $id;
   $_SESSION['sys_a']['name'] = $nome;
   $_SESSION['sys_b']['update'] = time();
}

Note: all this explained above is hypothetical, there is no way to know the functioning of your systems, it may be that use encrypted session or that has a complex structure, there is no magic way to synchronize 2 different systems, even more if it was not you who did, the only solution is for you to understand both systems or for them to provide Apis to facilitate this type of operation.

---

Answering the questions

When to use session_name() ?

When to use session_id() ?

Which is the safest ?

In short session_name even if you do not define is generated so, as the session_id, none of them have to do with security, each represents this in the COOKIE sent at HTTP:

Set-Cookie: <NOME DA SESSÃO>=<ID DA SESSÃO>

So set create in your PHP like this:

<?php
session_name('foo');
session_id('baz');
session_start();

echo 'Hello world!';

In HTTP the answer will probably be similar to this:

HTTP/1.1 200 OK
Connection: Keep-Alive
Content-Length: 12
Content-Type: text/html
Date: Wed, 10 Jan 2018 21:06:18 GMT
Keep-Alive: timeout=5, max=98
Set-Cookie: foo=baz; path=/

Hello world!

So session_name will be the cookie name and in the folder ./tmp a file with the name will be generated c:/php/temp/sess_baz, which is the same name as the ID.

Answer 2

First a session is a superglobal variable in array form, where you store data for a certain time.

According to the official documentation for session_id():

session_id() is used to obtain or define the session id for the current session.

And to session_name()

session_name - Fetches and/or sets the current session name

The difference of the two is in their purpose and a little in their operation, session_id is set once before logging in, and you will NOT need to call the method every time you need to use a session data, much of the session security comes from the function session_regenerate_id, and calling this method, you will generate a new identification for session without losing the data, however you will not be able to identify naturally which is each session, this is very useful for sessions open for a long time, because even if the identification is captured your identification will be modified during use.

To identify multiple sessions on the same server, the most feasible is the use of a session name, as this name will not interfere with your identifier and you can call anywhere any of the open sessionsdefined and yet remain governing the identifiers for the session.

References:

Basic use

Session ID

Session Regenerate ID

Session Name