Advanced Sessions 📦

<?php
// PHP's default sessions are plain files in /tmp on ONE server. Add a second
// server behind a load balancer and the file is missing — the user looks logged
// out. The fix: store sessions in a place EVERY server can reach (a database or
// Redis). You teach PHP to do that with a custom "save handler".

// A handler is just a class implementing SessionHandlerInterface. PHP calls
// these six methods for you at the right moments — you never call them directly.
class DatabaseSessionHandler implements SessionHandlerInterface
{
    public function __construct(private PDO $pdo) {}

    // open(): called by session_start(). Return true if storage is ready.
    public function open(string $path, string $name): bool { return true; }

    // close(): called when the request ends. Free resources, return true.
    public function close(): bool { return true; }

    // read(): PHP asks for the saved data for this session id.
    public function read(string $id): string
    {
        $stmt = $this->pdo->prepare(
            'SELECT payload FROM sessions WHERE id = ? AND expires_at > NOW()'
        );
        $stmt->execute([$id]);
        return (string) $stmt->fetchColumn();   // '' means "no session yet"
    }

    // write(): PHP hands back the data to save (an opaque serialized string).
    public function write(string $id, string $data): bool
    {
        // "Upsert" = insert a new row, or update it if the id already exists.
        $stmt = $this->pdo->prepare(
            'INSERT INTO sessions (id, payload, expires_at)
             VALUES (?, ?, DATE_ADD(NOW(), INTERVAL 30 MINUTE))
             ON DUPLICATE KEY UPDATE
                 payload = VALUES(payload),
                 expires_at = VALUES(expires_at)'
        );
        return $stmt->execute([$id, $data]);
    }

    // destroy(): called by session_destroy(). Delete this session's row.
    public function destroy(string $id): bool
    {
        return $this->pdo->prepare('DELETE FROM sessions WHERE id = ?')->execute([$id]);
    }

    // gc(): garbage collection — PHP runs this occasionally to bin old rows.
    public function gc(int $maxLifetime): int|false
    {
        $stmt = $this->pdo->prepare('DELETE FROM sessions WHERE expires_at < NOW()');
        $stmt->execute();
        return $stmt->rowCount();   // how many expired rows were removed
    }
}

$pdo = new PDO('mysql:host=localhost;dbname=app', 'user', 'pass');

// Register the handler, THEN start the session. The 'true' registers a
// shutdown function so write()/close() always run at the end of the request.
session_set_save_handler(new DatabaseSessionHandler($pdo), true);
session_start();   // from here, $_SESSION reads/writes go through the database

$_SESSION['user_id'] = 42;
$_SESSION['role']    = 'admin';
echo "Stored session for user {$_SESSION['user_id']} in the database.\n";

<?php
// For Redis you usually write NO handler at all — it ships with PHP. You point
// PHP at Redis in php.ini (or with ini_set before session_start()):
//
//   session.save_handler = redis
//   session.save_path    = "tcp://127.0.0.1:6379?auth=secret"
//
// Redis is in-memory (so it's the fastest option), shared across all your
// servers, and it expires keys automatically — perfect for sessions.

// Tune session behaviour with ini settings. Set these BEFORE session_start().
ini_set('session.gc_maxlifetime', '1800');  // server keeps data for 30 minutes
ini_set('session.cookie_lifetime', '0');    // cookie dies when browser closes
ini_set('session.use_strict_mode', '1');    // reject session ids PHP didn't issue
ini_set('session.cookie_httponly', '1');    // JavaScript cannot read the cookie
ini_set('session.cookie_secure', '1');      // cookie only sent over HTTPS
ini_set('session.cookie_samesite', 'Lax');  // helps block cross-site (CSRF) abuse

session_start();
echo "Session id: " . session_id() . "\n";   // the value stored in the cookie
echo "Storage backend: " . ini_get('session.save_handler') . "\n";

<?php
// Sessions LOCK. While one request holds an open session, PHP makes other
// requests from the SAME user WAIT until it calls session_write_close(). With
// AJAX-heavy pages this serialises requests and feels sluggish.

session_start();
$_SESSION['last_seen'] = time();   // do all your writes up front...

// ...then close the session AS SOON as you're done with it. This releases the
// lock so other requests for this user can proceed in parallel. $_SESSION stays
// readable in memory; you just can't write to storage after this point.
session_write_close();

echo "Lock released — slow work below no longer blocks other tabs.\n";

// Imagine a slow API call or report here. Because the lock is already gone,
// a second request (e.g. an autosave ping) doesn't queue behind it.
$report = "...expensive work that takes a few seconds...";
echo "Finished the slow part without holding the session lock.\n";

Lock released — slow work below no longer blocks other tabs.
Finished the slow part without holding the session lock.

<?php
// SESSION FIXATION: an attacker plants a known session id on a victim (e.g. via
// a link), the victim logs in, and the attacker now shares their logged-in
// session. Defence: give the user a BRAND-NEW id the moment privileges change.

session_start();

function login(int $userId): void
{
    // The single most important line in session security:
    session_regenerate_id(true);     // new id; 'true' deletes the OLD session

    $_SESSION['user_id']    = $userId;
    $_SESSION['logged_in']  = true;
    $_SESSION['ip']         = $_SERVER['REMOTE_ADDR'] ?? '';   // bind to a fingerprint
    $_SESSION['ua_hash']    = hash('sha256', $_SERVER['HTTP_USER_AGENT'] ?? '');
}

function logout(): void
{
    $_SESSION = [];                  // clear the data in memory
    session_destroy();               // delete it from storage
    setcookie(session_name(), '', time() - 3600, '/');   // expire the cookie too
}

// HIJACKING check: if the request's fingerprint no longer matches, drop it.
function isHijacked(): bool
{
    $ipChanged = ($_SESSION['ip'] ?? '') !== ($_SERVER['REMOTE_ADDR'] ?? '');
    $uaChanged = ($_SESSION['ua_hash'] ?? '')
        !== hash('sha256', $_SERVER['HTTP_USER_AGENT'] ?? '');
    return $ipChanged || $uaChanged;
}

login(42);
echo "Logged in as user {$_SESSION['user_id']} with a fresh session id.\n";

<?php
// 🎯 YOUR TURN — harden a login. Fill in each blank marked ___ , then run it
// on your own server (php -S localhost:8000) and inspect the cookie flags.

// 1) Set secure cookie params BEFORE the session starts
session_set_cookie_params([
    'lifetime' => 0,
    'httponly' => ___,        // 👉 true — block JavaScript from reading the cookie
    'secure'   => ___,        // 👉 true — only send the cookie over HTTPS
    'samesite' => ___,        // 👉 'Lax' — mitigate cross-site (CSRF) requests
]);
session_start();

// 2) After checking the password, rotate the id to stop session fixation
session_regenerate_id(___);   // 👉 true — also delete the old session

$_SESSION['user_id'] = 7;
echo "Secured login for user {$_SESSION['user_id']}.\n";

// ✅ Expected output:
//    Secured login for user 7.
?>

Secured login for user 7.

<?php
// 🎯 YOUR TURN — an AJAX endpoint that does slow work. Fill in the blank so the
// session lock is released BEFORE the slow part, freeing other tabs.

session_start();
$_SESSION['pings'] = ($_SESSION['pings'] ?? 0) + 1;   // record the visit

___;                          // 👉 session_write_close();  release the lock now

// Pretend this takes a few seconds — the lock is already gone, so a second
// request from the same user does NOT have to wait for it.
echo "Did slow work without blocking other requests.\n";

// ✅ Expected output:
//    Did slow work without blocking other requests.
?>

Did slow work without blocking other requests.