When there is a situation in client browser, when there is executed
some XSS session fixation script manipulation with HTTP only session id,
then there could be schizofrenic situation in browser local storrage.
When there is a situation in client browser, when there is executed
some XSS session fixation script manipulation with HTTP only session id,
then there could be schizofrenic situation in browser local storrage.
The script could look like this:
document.cookie="PHPSESSID=evil_value";
This creates in browser two cookies with the same name.
First cookie is from server side with HTTP ONLY
flag and the second cookie exists for javascript environment.
Then user could continue to next document and browser always sent both cookies.
But the HTTP only cookie is always send as second in Cookie header value cookies list.
But PHP engine takes always the first cookie value to start session.
To prevent atacks like that, take always the last session id value
in Cookie header list by fixing session id before session has been started.
Parameters