From 3ec11b23fa03fcfc307c163ab7456d1487e988f7 Mon Sep 17 00:00:00 2001 From: velz Date: Thu, 8 Jan 2026 16:05:35 +0530 Subject: [PATCH] FIX_SESSION_REPLAY --- app/Controllers/LoginController.php | 36 +++++++++++++------ app/Filters/AuthMVC.php | 23 ++++++++++-- app/Filters/Cors.php | 56 ++++++++++++++--------------- app/Filters/SecurityInputFilter.php | 1 + app/Helpers/session_helper.php | 6 ++-- app/Libraries/AuthLogout.php | 42 ++++++++++++++++++++++ public/.htaccess | 4 +-- 7 files changed, 122 insertions(+), 46 deletions(-) create mode 100644 app/Libraries/AuthLogout.php diff --git a/app/Controllers/LoginController.php b/app/Controllers/LoginController.php index 451765c2..779c788b 100755 --- a/app/Controllers/LoginController.php +++ b/app/Controllers/LoginController.php @@ -11,6 +11,8 @@ use CodeIgniter\API\ResponseTrait; use App\Models\UserModel; use App\Models\AuthHistoryModel; +use App\Libraries\AuthLogout; + class LoginController extends BaseController { use ResponseTrait; @@ -45,7 +47,7 @@ class LoginController extends BaseController $user_team = $UserModel->getUserTeamsByUserID($user->id); // dd($user_team); - + session()->regenerate(true); $session_data = [ 'isLoggedIn' => True , 'userid' => $user->id, @@ -56,9 +58,14 @@ class LoginController extends BaseController $path = getenv('cookie.Path'); $domain = getenv('cookie.Domain'); $https = getenv('ccokie.secure'); - setcookie('session_data', json_encode($session_data), time() + 12 * 60 * 60, $path, $domain, $https, true); + // setcookie('session_data', json_encode($session_data), time() + 12 * 60 * 60, $path, $domain, $https, true); set_session_data($session_data); + // Bind session to device + set_session_data(['fingerprint' => hash('sha256', + ($this->request->getUserAgent()->getAgentString() . '|' . ($this->request->getIPAddress() + )))]); + log_message('error', 'Set The UserId : `'. $user->id .'` in Session'); log_message('error', 'User Login Sucessfully'); @@ -91,14 +98,23 @@ class LoginController extends BaseController public function logout() { - $path = getenv('cookie.Path'); - session()->destroy(); - // setcookie('session_data', '', time() - 3600, $path); - $path = getenv('cookie.Path'); - $domain = getenv('cookie.Domain'); - $https = getenv('cookie.secure'); - setcookie('session_data',null, time() -3600, $path, $domain, $https, true); - return redirect()->to(base_url('login')); + // $path = getenv('cookie.Path'); + // session()->regenerate(true); + // session()->destroy(); + + // $path = getenv('cookie.Path'); + // $domain = getenv('cookie.Domain'); + // $https = getenv('cookie.secure'); + + // setcookie('session_data',null, time() - 42000, $path, $domain, $https, true); + // // return redirect()->to(base_url('login')); + // return redirect()->to(base_url('login')) + // ->setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0') + // ->setHeader('Pragma', 'no-cache') + // ->setHeader('Expires', 'Sat, 26 Jul 1997 05:00:00 GMT'); + + + return AuthLogout::logout(); } public function getUserDeviceInfo($userId, $type_of_user) diff --git a/app/Filters/AuthMVC.php b/app/Filters/AuthMVC.php index 1e0be969..efda2976 100755 --- a/app/Filters/AuthMVC.php +++ b/app/Filters/AuthMVC.php @@ -5,13 +5,30 @@ use CodeIgniter\Filters\FilterInterface; use CodeIgniter\HTTP\RequestInterface; use CodeIgniter\HTTP\ResponseInterface; +use App\Libraries\AuthLogout; + class AuthMVC implements FilterInterface { public function before(RequestInterface $request, $arguments = null) { - if (!check_session() && !check_cookie()) { - - return redirect()->to(base_url('/login')); + + if (!check_session()) + { + return AuthLogout::logout(); + } + + // if (!check_cookie()) + // { + // return AuthLogout::logout(); + // } + + // Fingerprint validation + $fp = hash('sha256', + $request->getUserAgent()->getAgentString() . '|' . $request->getIPAddress() + ); + + if (session()->get('fingerprint') !== $fp) { + return AuthLogout::logout(); } } diff --git a/app/Filters/Cors.php b/app/Filters/Cors.php index 6aae35d9..bb8d5b8b 100644 --- a/app/Filters/Cors.php +++ b/app/Filters/Cors.php @@ -143,7 +143,7 @@ class Cors implements FilterInterface // If wildcard present in configuration, allow any origin if (in_array('*', $this->allowedOrigins, true)) { - $this->log('Origin allowed: wildcard match', ['origin' => $origin]); + // $this->log('Origin allowed: wildcard match', ['origin' => $origin]); return true; } @@ -159,10 +159,10 @@ class Cors implements FilterInterface // 1. Exact match (including scheme and port) // Example: https://example.com matches https://example.com if (strcasecmp($allowed, $origin) === 0) { - $this->log('Origin allowed: exact match', [ - 'origin' => $origin, - 'matched_rule' => $allowed - ]); + // $this->log('Origin allowed: exact match', [ + // 'origin' => $origin, + // 'matched_rule' => $allowed + // ]); return true; } @@ -178,11 +178,11 @@ class Cors implements FilterInterface // Check if origin host ends with the allowed root domain if ($originHost === $allowedRoot || str_ends_with($originHost, '.' . $allowedRoot)) { - $this->log('Origin allowed: wildcard subdomain match', [ - 'origin' => $origin, - 'matched_rule' => $allowed, - 'origin_host' => $originHost - ]); + // $this->log('Origin allowed: wildcard subdomain match', [ + // 'origin' => $origin, + // 'matched_rule' => $allowed, + // 'origin_host' => $originHost + // ]); return true; } } @@ -191,11 +191,11 @@ class Cors implements FilterInterface // Example: example.com matches both http://example.com and https://example.com else { if (strcasecmp($allowed, $originHost) === 0) { - $this->log('Origin allowed: host match (scheme-less)', [ - 'origin' => $origin, - 'matched_rule' => $allowed, - 'origin_host' => $originHost - ]); + // $this->log('Origin allowed: host match (scheme-less)', [ + // 'origin' => $origin, + // 'matched_rule' => $allowed, + // 'origin_host' => $originHost + // ]); return true; } } @@ -320,11 +320,11 @@ class Cors implements FilterInterface // Preflight is sent by browsers before actual cross-origin requests // to check if the actual request is safe to send if ($method === 'OPTIONS') { - $this->log('Preflight request received', [ - 'origin' => $origin, - 'method' => $method, - 'uri' => (string) $request->getUri() - ]); + // $this->log('Preflight request received', [ + // 'origin' => $origin, + // 'method' => $method, + // 'uri' => (string) $request->getUri() + // ]); // Validate origin - reject if not allowed if (empty($origin) || !$this->isOriginAllowed($origin)) { @@ -346,10 +346,10 @@ class Cors implements FilterInterface $response->setStatusCode(204); $response->setBody(''); - $this->log('Preflight approved', [ - 'origin' => $origin, - 'allowed_methods' => $this->allowedMethods - ]); + // $this->log('Preflight approved', [ + // 'origin' => $origin, + // 'allowed_methods' => $this->allowedMethods + // ]); return $response; } @@ -392,10 +392,10 @@ class Cors implements FilterInterface // Add CORS headers to the response $this->addCorsHeaders($response, $request, $origin, false); - $this->log('CORS headers added to response', [ - 'origin' => $origin, - 'status' => $response->getStatusCode() - ]); + // $this->log('CORS headers added to response', [ + // 'origin' => $origin, + // 'status' => $response->getStatusCode() + // ]); } /** diff --git a/app/Filters/SecurityInputFilter.php b/app/Filters/SecurityInputFilter.php index 9ee24857..c23f7907 100644 --- a/app/Filters/SecurityInputFilter.php +++ b/app/Filters/SecurityInputFilter.php @@ -32,6 +32,7 @@ class SecurityInputFilter implements FilterInterface '/<\s*object\b/i', '/<\s*embed\b/i', '/<\s*applet\b/i', + '/<\s*img\b/i', // Image-based execution '/<\s*img\b[^>]*on\w+/i', diff --git a/app/Helpers/session_helper.php b/app/Helpers/session_helper.php index 31162658..640de0e7 100755 --- a/app/Helpers/session_helper.php +++ b/app/Helpers/session_helper.php @@ -21,7 +21,7 @@ if(!function_exists('check_cookie')){ 'userProfile' => $value['userProfile'], 'user_team' => $user_team, ]; - set_session_data($session_data); + // set_session_data($session_data); // $this->getUserDeviceInfo($user->id, 'NhanceUser'); // return redirect()->to(base_url('/dashboard/view')); return true; @@ -33,6 +33,7 @@ if(!function_exists('check_cookie')){ }else{ return false; } + } } if (!function_exists('check_session')) { @@ -40,7 +41,7 @@ if (!function_exists('check_session')) { { // $ci =& get_instance(); $session = \Config\Services::session(); - return $session->get('isLoggedIn'); + return $session->get('isLoggedIn') === true; } } @@ -201,7 +202,6 @@ if (!function_exists('get_chatbot_session_info')) { } -} diff --git a/app/Libraries/AuthLogout.php b/app/Libraries/AuthLogout.php new file mode 100644 index 00000000..cfb10051 --- /dev/null +++ b/app/Libraries/AuthLogout.php @@ -0,0 +1,42 @@ +regenerate(true); + + // Destroy CI session + $session->destroy(); + + // Kill PHP session cookie safely + if (ini_get('session.use_cookies')) { + $params = session_get_cookie_params(); + + setcookie( + session_name(), // DO NOT hardcode cookie name + '', + time() - 42000, + $params['path'], + $params['domain'], + $params['secure'], + $params['httponly'] + ); + } + + session_write_close(); + + // Redirect with anti-cache headers + return redirect()->to(base_url('login')) + ->setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0') + ->setHeader('Pragma', 'no-cache') + ->setHeader('Expires', 'Sat, 26 Jul 1997 05:00:00 GMT'); + } +} diff --git a/public/.htaccess b/public/.htaccess index c8b54695..f82f3842 100755 --- a/public/.htaccess +++ b/public/.htaccess @@ -6,7 +6,7 @@ Options -Indexes # ---------------------------------------------------------------------- ## ADDED for - block any script execution inside folder of public - + Deny from all # Disable PHP engine @@ -18,7 +18,7 @@ Options -Indexes AddHandler cgi-script .php .pl .py .jsp .asp .sh .cgi # Block access to any script-like files entirely - + ForceType text/plain #Order allow,deny Deny from all