Sessions and session_create_id() with Prefix and strict mode config set to on

My objective is to create a more secure session id.I am attempting to prefix a sha1 hash on to the existing Session, Though my concern now is that in order to do this I have to shut strict mode off is there a way to do this while keeping strict mode on?

function sess_regenration(){
if (session_status() == PHP_SESSION_NONE){

//CreateRandomStringForPrefix
$RandomizerForPreFix = str_split("0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
shuffle($RandomizerForPreFix);
$EmptyStringToAppenRandomizer = '';

foreach($RandomizerForPreFix as $Element ){
$EmptyStringToAppenRandomizer .= $Element;
}

//HashShuffle
$HashedValue = sha1($Element);
//CreateNewSessionIdWithPrefix
ini_set('session.use_strict_mode',0);
$CreatedId = session_create_id($HashedValue);
session_id($CreatedId);
//StartSession
session_start();
$_SESSION['name'] = htmlentities($_POST['name']);
echo session_id();
}

}


sess_regenration();
}


1 Answer
1

There's an easier way to do it. There's a setting in php.ini called session.hash_function which accepts a numerical value. To get the value that you need, run the hash_algos() function in a script on its own. That will give you an array of all hashing algorithms available. Say it had sha1 as the fourth value in the array, you'd take it's index in the array (3) and give that to session.hash_function as the one to use so that would read in the example:

session.hash_function 3


Don't forget to reboot the server after having made the change to php.ini

You might want to write a small bit of code to run before session_start() is called to check the index of sha1 in the array returned by hash_algos() and set the value for session.hash_function via ini_set()

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.