iriven / phpsession

A lightweight but powerful and secure PHP session Class

PHPSession

The Iriven PHP Session class endeavors to make it easy to use basic session best practices in PHP scripts.

Setup

---

Add a composer.json file to your project:

{
  "require": {
      "Iriven/PHPSession": "v1.0.0"
  }
}

Then provided you have composer installed, you can run the following command:

$ composer.phar install

That will fetch the library and its dependencies inside your vendor folder. Then you can add the following to your .php files in order to use the library (if you don't already have one).

require 'vendor/autoload.php';

Then you need to use the relevant class, and instantiate the class. For example:

Getting Started

---

require 'vendor/autoload.php';
use \Iriven\Plugin\Sessions\PHPSession;

$session = new PHPSession();

Features

---

• Protects against fixation attacks by regenerating the ID periodically.
• Prevents session run conditions caused by rapid concurrent connections (such as when Ajax is in use).
• Locks a session to a user agent and ip address to prevent theft.
• Supports users behind proxies by identifying proxy headers in requests.
• Easy to create, manage, and destroy session values.
• supports flash messages
• HTTPOnly session cookie
• Session fingerprint validation
• supports PHP objects vars storage

Examples

---

Logging in. (login.php)

<?php
    use \Iriven\Plugin\Sessions\PHPSession;
    require 'vendor/autoload.php';


    // You'll definitely want to add more validation here and check against a
    // database or something. This is just an example.
    if (! empty($_POST)) {
        $session = new PHPSession();
        $session->start(30); // Register for 30 minutes inactive delay.
        if ($_POST['username'] == 'user' && $_POST['password'] == 'pwd') {
            
            // You can define what you like to be stored.
            $user = array(
                'user_id' => 1,
                'username' => $_POST['username']
            );
            $session->registerUser($user);
            $session->flash()->success('Login OK.');
            header('location: '.$session->referer('index.php'));
            exit;
        } else {
            $session->flash()->error('Invalid login.');
        }
    }
?>

 $session->flash()->display();
// Your form here.

Secure area once authenticated. (index.php/controller/whatever)

<?php
    use \Iriven\Plugin\Sessions\PHPSession;
    require 'vendor/autoload.php';

    $session = new PHPSession();
        // Check to see if the session has expired.
        // If it has, end the session and redirect to login.
        if(!$session->isStarted())
        {
            $session->start(30); // Register for 30 minutes inactive delay.
            $session->saveReferer($_SERVER['REQUEST-URI']);
            header('location: login.php');
            exit;
        }
        elseif(!$session->userIsAuthenticated()) 
        {
            $session->close();
            header('location: login.php');
            exit;
        } 
        // Keep renewing the session as long as they keep taking action.
        $session->regenerate();
?>

Logging out. (logout.php)

<?php
    use \Iriven\Plugin\Sessions\PHPSession;
    require 'vendor/autoload.php';

    $session = new PHPSession();
    $session->close();
    header('location: login.php');
    exit;
?>

Authors

---

• Alfred TCHONDJO - Project Initiator - iriven France

License

---

This project is licensed under the GNU General Public License V3 - see the LICENSE file for details

Donation

---

If this project help you reduce time to develop, you can give me a cup of coffee :)

Disclaimer

---

If you use this library in your project please add a backlink to this page by this code.

<a href="https://github.com/iriven/PHPSession" target="_blank">This Project Uses Alfred's TCHONDJO PHPSession Library.</a>