Vengala Vinay

Having 12+ Years of Experience in Software Development

Home » How We Audited a High-Traffic PHP Enterprise Stack on Google Cloud and Mitigated session hijacking through unencrypted session files storage

How We Audited a High-Traffic PHP Enterprise Stack on Google Cloud and Mitigated session hijacking through unencrypted session files storage

Unearthing the Vulnerability: Session File Storage on Google Cloud

Our recent security audit of a high-traffic enterprise PHP application hosted on Google Cloud Platform (GCP) revealed a critical vulnerability: unencrypted storage of session files. This oversight, while seemingly minor, presented a significant risk of session hijacking, especially in multi-tenant or shared hosting environments. The application utilized PHP’s default session handling mechanism, which, by default, writes session data to files on the server’s local filesystem. In a cloud environment, particularly with auto-scaling and ephemeral instances, the exact location and accessibility of these files become paramount.

The default session save path in PHP is often configured via `php.ini` or set dynamically within the application. For many deployments, especially those managed by container orchestration platforms like Kubernetes or even simpler Compute Engine instances, this path might resolve to a directory within the application’s writable volume or a shared network mount. Without explicit encryption at rest or strict access controls, these files become potential targets.

Identifying the Session Save Path

The first step in our audit was to precisely identify where PHP was storing session data. This can be achieved through several methods:

  • `phpinfo()` Output: The most straightforward method is to create a temporary PHP file containing only phpinfo();. This will display detailed information about the PHP environment, including the ‘session.save_path’ directive.
  • Runtime Inspection: If direct `phpinfo()` access is restricted, we can inspect the session save path programmatically within the application’s code.
  • Server Configuration Review: Examining `php.ini` files, Apache/Nginx configuration snippets that affect PHP (`php-fpm.conf`, `.htaccess` if applicable), and container entrypoint scripts can reveal the configured path.

In this specific GCP deployment, the application was running within a Kubernetes cluster. The session save path was configured via a `php-fpm` configuration file mounted as a ConfigMap. The path was set to /var/lib/php/sessions, a standard location on many Linux distributions.

The Risk: Session Hijacking via File Access

The core vulnerability lies in the accessibility of these session files. If an attacker gains even read access to the filesystem where session files are stored, they can potentially read the session ID and associated data of other users. On GCP, this could happen through:

  • Compromised Application Instance: If one instance of the application is compromised, an attacker might be able to traverse the filesystem and access session files of other instances, especially if they reside on a shared volume or are not properly isolated.
  • Misconfigured Storage: If session files were inadvertently directed to a publicly accessible cloud storage bucket (e.g., an improperly secured GCS bucket) or a network file system with weak access controls, the risk escalates dramatically.
  • Container Escapes: A vulnerability allowing an attacker to break out of a container could grant them access to the host’s filesystem, where session files might be stored.
  • Insider Threats: Malicious or negligent administrators with filesystem access could also exploit this.

Once an attacker obtains a valid session ID and its associated data, they can often impersonate the legitimate user by setting their own session cookie to that ID, bypassing authentication and gaining unauthorized access to sensitive information and functionality.

Mitigation Strategy 1: Encrypting Session Data at Rest

The most direct mitigation is to ensure session data is encrypted before it’s written to disk. PHP offers a built-in mechanism for this via the session.serialize_handler directive. We can leverage custom serialization handlers to encrypt/decrypt session data on the fly.

Here’s a conceptual implementation using OpenSSL for AES-256-CBC encryption. This requires a securely managed encryption key.

Custom Session Save Handler for Encryption

We’ll define a custom session save handler class that intercepts the `read` and `write` operations.

Encryption Key Management

The encryption key must be stored securely. For GCP, using Secret Manager is the recommended approach. The application would fetch the key at startup.

PHP Implementation

First, ensure you have the OpenSSL extension enabled in your PHP installation. Then, create a PHP file (e.g., EncryptedSessionHandler.php) with the following class:

EncryptedSessionHandler.php
<?php

class EncryptedSessionHandler implements SessionHandlerInterface {
    private $savePath;
    private $sessionName;
    private $key;
    private $cipher = 'aes-256-cbc';
    private $iv_len = 16; // For AES-256-CBC

    public function __construct(string $key, string $savePath = '/tmp', string $sessionName = 'PHPSESSID') {
        // Ensure key is 32 bytes for AES-256
        if (strlen($key) !== 32) {
            throw new \InvalidArgumentException('Encryption key must be 32 bytes for AES-256.');
        }
        $this->key = $key;
        $this->savePath = $savePath;
        $this->sessionName = $sessionName;

        // Ensure save path exists
        if (!is_dir($this->savePath)) {
            if (!mkdir($this->savePath, 0700, true)) {
                throw new \RuntimeException("Failed to create session save path: {$this->savePath}");
            }
        }
    }

    private function getSessionFilePath(string $session_id): string {
        return $this->savePath . DIRECTORY_SEPARATOR . 'sess_' . $this->sessionName . '_' . $session_id;
    }

    private function encrypt(string $data): string {
        $iv = openssl_random_pseudo_bytes($this->iv_len);
        $encrypted = openssl_encrypt($data, $this->cipher, $this->key, OPENSSL_RAW_DATA, $iv);
        if ($encrypted === false) {
            throw new \RuntimeException('OpenSSL encryption failed: ' . openssl_error_string());
        }
        // Prepend IV to the encrypted data
        return base64_encode($iv . $encrypted);
    }

    private function decrypt(string $data): string {
        $decoded = base64_decode($data);
        if ($decoded === false) {
            throw new \RuntimeException('Base64 decoding failed.');
        }
        $iv = substr($decoded, 0, $this->iv_len);
        $encrypted_data = substr($decoded, $this->iv_len);

        $decrypted = openssl_decrypt($encrypted_data, $this->cipher, $this->key, OPENSSL_RAW_DATA, $iv);
        if ($decrypted === false) {
            throw new \RuntimeException('OpenSSL decryption failed: ' . openssl_error_string());
        }
        return $decrypted;
    }

    public function open(string $savePath, string $sessionName): bool {
        $this->savePath = $savePath;
        $this->sessionName = $sessionName;
        return true;
    }

    public function close(): bool {
        return true;
    }

    public function read(string $session_id): string {
        $filePath = $this->getSessionFilePath($session_id);
        if (!file_exists($filePath) || !is_readable($filePath)) {
            return '';
        }

        $encrypted_data = file_get_contents($filePath);
        if ($encrypted_data === false) {
            return '';
        }

        try {
            return $this->decrypt($encrypted_data);
        } catch (\RuntimeException $e) {
            // Log decryption error, but return empty to prevent session corruption
            error_log("Session decryption failed for ID {$session_id}: " . $e->getMessage());
            return '';
        }
    }

    public function write(string $session_id, string $data): bool {
        $filePath = $this->getSessionFilePath($session_id);
        try {
            $encrypted_data = $this->encrypt($data);
            if (file_put_contents($filePath, $encrypted_data, LOCK_EX) === false) {
                return false;
            }
            // Set appropriate permissions, especially if on shared storage
            chmod($filePath, 0600);
            return true;
        } catch (\RuntimeException $e) {
            error_log("Session encryption/write failed for ID {$session_id}: " . $e->getMessage());
            return false;
        }
    }

    public function destroy(string $session_id): bool {
        $filePath = $this->getSessionFilePath($session_id);
        if (file_exists($filePath)) {
            return unlink($filePath);
        }
        return true;
    }

    public function gc(int $maxlifetime): bool {
        $files = glob($this->savePath . DIRECTORY_SEPARATOR . 'sess_' . $this->sessionName . '_*');
        if ($files === false) {
            return false;
        }

        foreach ($files as $file) {
            if (is_file($file) && (filemtime($file) + $maxlifetime < time())) {
                unlink($file);
            }
        }
        return true;
    }
}

Registering the Custom Handler

In your application’s bootstrap process (e.g., index.php or a dedicated bootstrap file), before starting the session, register this handler. You’ll need to fetch your encryption key from GCP Secret Manager.

Example Bootstrap Snippet

<?php
require_once 'EncryptedSessionHandler.php';

// --- GCP Secret Manager Integration Example ---
// This is a simplified example. In a real-world scenario,
// use the official Google Cloud PHP client library.
function getSecretFromGCP(string $secretName, string $version = 'latest'): string {
    // Replace with actual GCP Secret Manager client logic
    // Example:
    // $client = new Google\Cloud\SecretManager\V1\SecretManagerServiceClient();
    // $name = $client->secretVersionName($projectId, $secretName, $version);
    // $response = $client->accessSecretVersion($name);
    // return $response->getPayload()->getData();

    // For demonstration, returning a placeholder.
    // Ensure this key is 32 bytes long.
    $placeholderKey = str_repeat('a', 32); // !!! REPLACE WITH REAL KEY !!!
    if (strlen($placeholderKey) !== 32) {
        throw new \RuntimeException("Placeholder key is not 32 bytes. Update it.");
    }
    return $placeholderKey;
}

$encryptionKey = getSecretFromGCP('my-php-app-session-key'); // Name of your secret in GCP Secret Manager
$sessionSavePath = '/var/lib/php/sessions'; // Ensure this path is writable by the web server/PHP-FPM
$sessionName = 'APP_SESSION'; // Custom session name

try {
    $handler = new EncryptedSessionHandler($encryptionKey, $sessionSavePath, $sessionName);
    if (!session_set_save_handler($handler, true)) {
        throw new \RuntimeException("Failed to set custom session save handler.");
    }
} catch (\Exception $e) {
    // Handle error: log it, display a user-friendly message, or terminate
    error_log("Session handler initialization failed: " . $e->getMessage());
    // Depending on severity, you might want to die() or show an error page
    die("Critical error: Could not initialize session handling.");
}

// Set session cookie parameters if needed (e.g., HttpOnly, Secure, SameSite)
ini_set('session.cookie_httponly', 1);
ini_set('session.cookie_secure', 1); // Set to 1 if using HTTPS exclusively
ini_set('session.cookie_samesite', 'Lax'); // Or 'Strict' depending on needs

// Start the session AFTER setting the handler
session_start();

// Now you can use $_SESSION as usual
// $_SESSION['user_id'] = 123;
// echo 'Session started.';
?>

Important Considerations:

  • Key Rotation: Implement a strategy for rotating the encryption key periodically. This involves updating the secret in GCP Secret Manager and potentially migrating existing session data if the old key is retired.
  • Performance Impact: Encryption and decryption add overhead. For extremely high-traffic applications, benchmark the performance impact. Ensure your PHP instances have sufficient CPU resources.
  • Error Handling: Robust error handling is crucial. If encryption or decryption fails, the session data might be lost or corrupted. Log these errors diligently.
  • Session ID Security: While data is encrypted, the session ID itself is still transmitted. Ensure session IDs are regenerated upon login (session fixation prevention) and use secure cookie flags (HttpOnly, Secure, SameSite).

Mitigation Strategy 2: Leveraging GCP Managed Services

For many modern applications, moving away from file-based sessions entirely is a more scalable and secure approach. GCP offers several managed services that can act as robust session stores.

Using Memorystore (Redis/Memcached)

Google Cloud Memorystore provides managed Redis and Memcached instances. These in-memory data stores are excellent for session management due to their speed and ability to handle concurrent access.

PHP Redis Session Handler

Ensure the Redis extension for PHP is installed and enabled.

<?php
// Ensure Redis extension is enabled
if (!extension_loaded('redis')) {
    die("Redis extension is not loaded.");
}

// Configure your Memorystore instance details
$redisHost = 'YOUR_MEMORSTORE_HOST'; // e.g., 10.0.0.5 (private IP) or your Redis endpoint
$redisPort = 6379;
$redisPassword = ''; // If you've configured authentication
$sessionPrefix = 'sess_'; // Prefix for session keys in Redis

// Set session cookie parameters
ini_set('session.cookie_httponly', 1);
ini_set('session.cookie_secure', 1); // Use only over HTTPS
ini_set('session.cookie_samesite', 'Lax');

// Configure PHP to use Redis for sessions
ini_set('session.save_handler', 'redis');
ini_set('session.save_path', "tcp://{$redisHost}:{$redisPort}?auth={$redisPassword}&prefix={$sessionPrefix}");

// Start the session
session_start();

// $_SESSION['user_id'] = 123;
// echo 'Session started using Redis.';
?>

Advantages:

  • Performance: Significantly faster than file-based sessions.
  • Scalability: Handles high traffic loads better.
  • Centralized Store: All application instances share the same session data, crucial for auto-scaling environments.
  • Reduced Attack Surface: No sensitive session files on individual instances.

Considerations:

  • Persistence: Redis is primarily in-memory. Configure persistence options (RDB snapshots, AOF) if session data loss upon instance restart is unacceptable, though for sessions, this is often less critical than for primary data stores.
  • Security: Ensure your Memorystore instance is configured with private IP access and, if necessary, authentication (using Redis AUTH). Do not expose it to the public internet.
  • Cost: Managed services incur costs.

Using Cloud SQL (PostgreSQL/MySQL)

While less common for pure session storage due to latency compared to in-memory stores, using a relational database like Cloud SQL is an option, especially if you already have one in use.

PHP Database Session Handler

PHP includes a built-in handler for database sessions. You’ll need a database table to store session data.

Database Schema Example (MySQL)
CREATE TABLE sessions (
    session_id VARCHAR(128) NOT NULL PRIMARY KEY,
    session_data TEXT NOT NULL,
    last_access TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    expiry INT UNSIGNED NOT NULL
);
PHP Configuration
<?php
// Database connection details (use secure methods like environment variables or Secret Manager)
$dbHost = 'YOUR_CLOUD_SQL_HOST'; // e.g., 10.0.0.10 or your Cloud SQL instance IP
$dbPort = 3306;
$dbUser = 'your_db_user';
$dbPass = 'your_db_password';
$dbName = 'your_database_name';
$tableName = 'sessions';

// Set session cookie parameters
ini_set('session.cookie_httponly', 1);
ini_set('session.cookie_secure', 1); // Use only over HTTPS
ini_set('session.cookie_samesite', 'Lax');

// Configure PHP to use database for sessions
ini_set('session.save_handler', 'user'); // Use user-defined handler
ini_set('session.save_path', "{$dbHost}:{$dbPort}/{$dbName}/{$tableName}"); // Format: host:port/database/table

// --- Custom User Session Handler ---
// You would typically implement a class that implements SessionHandlerInterface
// and registers it using session_set_save_handler().
// For brevity, this example shows the ini settings.
// A full implementation would involve PDO/MySQLi for DB interaction.

// Example of how you'd register a custom handler (conceptual)
/*
class DbSessionHandler implements SessionHandlerInterface {
    private $db;
    private $tableName;
    private $sessionName;

    public function __construct(PDO $db, string $tableName, string $sessionName) {
        $this->db = $db;
        $this->tableName = $tableName;
        $this->sessionName = $sessionName;
    }

    // Implement open, close, read, write, destroy, gc methods using PDO
    public function read(string $session_id): string {
        // ... query database ...
        return $session_data;
    }
    public function write(string $session_id, string $data): bool {
        // ... insert/update database ...
        return true/false;
    }
    // ... other methods ...
}

// $pdo = new PDO(...); // Your PDO connection
// $handler = new DbSessionHandler($pdo, $tableName, session_name());
// session_set_save_handler($handler, true);
*/

// Start the session
session_start();

// $_SESSION['user_id'] = 123;
// echo 'Session started using Cloud SQL.';
?>

Considerations:

  • Performance: Generally slower than Redis/Memcached due to disk I/O and network latency.
  • Database Load: Session operations can significantly increase database load. Ensure your Cloud SQL instance is adequately provisioned.
  • Schema Management: Requires maintaining the session table schema.

Mitigation Strategy 3: Securing the Filesystem (Least Recommended)

If migrating away from file-based sessions is not immediately feasible, hardening the filesystem access is the minimum viable security measure. This is generally less robust than the other methods.

Filesystem Permissions and Isolation

Ensure the session save path directory has the most restrictive permissions possible, typically 0700 (owner read/write/execute only). The web server user (e.g., www-data, apache, nginx) should be the only user with access.

# Example: Set permissions on the session directory
sudo chown www-data:www-data /var/lib/php/sessions
sudo chmod 700 /var/lib/php/sessions

In Kubernetes, this means ensuring the Pod’s service account doesn’t have excessive privileges, and any mounted volumes for sessions are restricted. If using Persistent Volumes, ensure their access modes (e.g., ReadWriteOnce) and underlying storage class security are appropriate.

Using GCP Filestore or Cloud Storage (with caveats)

Storing session files on network-attached storage like GCP Filestore or even Cloud Storage (mounted via FUSE or similar) introduces complexity. While Filestore offers NFS, its security relies heavily on network-level controls (VPC firewall rules, private IPs). Cloud Storage itself is object storage and not directly suitable for file-based session handlers without significant abstraction layers, which would likely negate any performance benefits.

Recommendation: Avoid these for direct file-based session storage if possible. If used, ensure strict network isolation and IAM policies.

Conclusion and Recommendations

The unencrypted storage of session files is a significant security risk that can lead to session hijacking. Our audit identified this vulnerability in a high-traffic PHP application on GCP. The recommended mitigation strategies, in order of preference, are:

  • Migrate to Managed Services: Utilize Google Cloud Memorystore (Redis) for fast, scalable, and secure session management. This is the most robust solution for cloud-native applications.
  • Implement Server-Side Encryption: If file-based sessions must persist, implement strong encryption using a custom session handler and securely manage keys with GCP Secret Manager.
  • Harden Filesystem Access: As a last resort, enforce strict filesystem permissions and isolation, but understand this offers the least protection against sophisticated attacks.

For CTOs and VPs of Engineering, prioritizing the security of user sessions is non-negotiable. Regularly auditing session management practices, especially when deploying to cloud environments, is critical to protecting user data and maintaining trust.

Recent Posts

Top Categories

Our Products

Our Services