If you see the error message, "Cannot modify header information - headers already sent", or, "You must call .. before any output has been sent to the browser; output started in ...", then carefully examine the immediate cause (function or method) associated with the message. Any actions that require sending HTTP headers, such as modifying the browser's cookie, must be done before sending normal output (unbuffered output), except when using PHP's output buffering.

Introduction: Best practice in relation to using sessions with ZF calls for using a browser cookie (i.e. a normal cookie stored in your web browser), instead of embedding a unique session identifier in URLs as a means to track individual users. By default this component uses only cookies to maintain session identifiers. The cookie's value is the unique identifier of your browser's session. PHP's ext/session uses this identifier to maintain a unique one-to-one relationship between website visitors, and persistent session data storage unique to each visitor. Zend_Session* wraps this storage mechanism ($_SESSION) with an object-oriented interface. Unfortunately, if an attacker gains access to the value of the cookie (the session id), an attacker might be able to hijack a visitor's session. This problem is not unique to PHP, or the Zend Framework. The regenerateId() method allows an application to change the session id (stored in the visitor's cookie) to a new, random, unpredictable value. Note: Although not the same, to make this section easier to read, we use the terms "user agent" and "web browser" interchangeably.

Why?: If an attacker obtains a valid session identifier, an attacker might be able to impersonate a valid user (the victim), and then obtain access to confidential information or otherwise manipulate the victim's data managed by your application. Changing session ids helps protect against session hijacking. If the session id is changed, and an attacker does not know the new value, the attacker can not use the new session id in their attempts to hijack the visitor's session. Even if an attacker gains access to an old session id, regenerateId() also moves the session data from the old session id "handle" to the new one, so no data remains accessible via the old session id.

When to use regenerateId(): Adding Zend_Session::regenerateId() to your Zend Framework bootstrap yields one of the safest and most secure ways to regenerate session id's in user agent cookies. If there is no conditional logic to determine when to regenerate the session id, then there are no flaws in that logic. Although regenerating on every request prevents several possible avenues of attack, not everyone wants the associated small performance and bandwidth cost. Thus, applications commonly try to dynamically determine situations of greater risk, and only regenerate the session ids in those situations. Whenever a website visitor's session's privileges are "escalated" (e.g. a visitor re-authenticates their identity before editing their personal "profile"), or whenever a security "sensitive" session parameter change occurs, consider using regenerateId() to create a new session id. If you call the rememberMe() function, then don't use regenerateId(), since the former calls the latter. If a user has successfully logged into your website, use rememberMe() instead of regenerateId().

Avoiding cross-site script (XSS) vulnerabilities helps preventing session hijacking. According to Secunia's statistics XSS problems occur frequently, regardless of the languages used to create web applications. Rather than expecting to never have a XSS problem with an application, plan for it by following best practices to help minimize damage, if it occurs. With XSS, an attacker does not need direct access to a victim's network traffic. If the victim already has a session cookie, Javascript XSS might allow an attacker to read the cookie and steal the session. For victims with no session cookies, using XSS to inject Javascript, an attacker could create a session id cookie on the victim's browser with a known value, then set an identical cookie on the attacker's system, in order to hijack the victim's session. If the victim visited an attacker's website, then the attacker can also emulate most other identifiable characteristics of the victim's user agent. If your website has an XSS vulnerability, the attacker might be able to insert an AJAX Javascript that secretly "visits" the attacker's website, so that the attacker knows the victim's browser characteristics and becomes aware of a compromised session at the victim website. However, the attacker can not arbitrarily alter the server-side state of PHP sessions, provided the developer has correctly set the value for the save_path option.

By itself, calling Zend_Session::regenerateId() when the user's session is first used, does not prevent session fixation attacks, unless you can distinguish between a session originated by an attacker emulating the victim. At first, this might sound contradictory to the previous statement above, until we consider an attacker who first initiates a real session on your website. The session is "first used" by the attacker, who then knows the result of the initialization (regenerateId()). The attacker then uses the new session id in combination with an XSS vulnerability, or injects the session id via a link on the attacker's website (works if use_only_cookies = off).

If you can distinguish between an attacker and victim using the same session id, then session hijacking can be dealt with directly. However, such distinctions usually involve some form of usability tradeoffs, because the methods of distinction are often imprecise. For example, if a request is received from an IP in a different country than the IP of the request when the session was created, then the new request probably belongs to an attacker. Under the following conditions, there might not be any way for a website application to distinguish between a victim and an attacker:

The sample code below makes it much harder for an attacker to know the current victim's session id, unless the attacker has already performed the first two steps above.

<?php
require_once 'Zend/Session.php';
$defaultNamespace = new Zend_Session_Namespace();

if (!isset($defaultNamespace->initialized))
{
    Zend_Session::regenerateId();
    $defaultNamespace->initialized = true;
}
?>