Session Handling Setup Just wanted to run through my PHP session handling and get some feedback and tips with regard to what is good (if anything!), what could be better and what is either plain wrong, or using out of date methods.

Just as a bit of background, I have only ever dabbled with PHP (and many years ago that was) and want to try and embrace the OOP side of it.

Every page that is required to be part of a session has the following at the top:

&lt;?php
include_once 'Session.php';

$session = new Session();
$session-&gt;authenticate();
?&gt;


Session.php is as follows:
    

class Session {
    const password = "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8";
    private $sessionInfo;

    public function __construct() {
        session_start();
        if (!isset($_SESSION['sessionInfo'])) {
            $sessionInfo = new SessionInfo();
            $_SESSION['sessionInfo'] = $sessionInfo;
        } else {
            $sessionInfo = $_SESSION['sessionInfo'];
        }
    }

    public function authenticate() {
        if (isset($_SESSION['loggedin'])) {
            if ($_SESSION['loggedin'] === true) {
                return;
            }
        }
        header('Location: login.php');
    }

    public function logIn($password) {
        if (sha1($password) === self::password) {
            $_SESSION['loggedin'] = true;
            header('Location: index.php');
        }
    }

    public function logOut() {
        unset($_SESSION['loggedin']);
        session_destroy();
        header('Location: login.php');
    }

    public function getSessionInfo() {
        return $this-&gt;sessionInfo;
    }
}

?&gt;


SessionInfo is currently just a blank class, it's intended purpose is to act as an information store for the current session.

login.php:

&lt;?php
include_once 'Session.php';
    if(isset($_POST['submit'])) {
        if(isset($_POST['password'])) {
            $session = new Session();
            $session-&gt;logIn($_POST['password']);
        }

    }
?&gt;
&lt;html&gt;
    &lt;body&gt;
        &lt;form method="post" action="&lt;?php echo $_SERVER['PHP_SELF'];?&gt;"&gt;
            &lt;input type="password" name="password" /&gt;
            &lt;input type="submit" name="submit" /&gt;
        &lt;/form&gt;
    &lt;/body&gt;
&lt;/html&gt;


Do I need to call die() (or exit() seeing as they are identical) after a failed authenticate to terminate any page which may attempt to load? Or do I need to return a boolean and then terminate from the calling page?

Please disregard the use of SHA1 and the hashed password in the file, I will be extending this to use a MySQL background, and hope to incorporate the use of a salted hash. I will be using prepared statements, will this be sufficient to protect from SQL injection and allow me to not bother filtering $_POST[...]?

Also, I realise that the location headers may better be stored as a class constant in case I wish to change the locations.
Let's see the code:


Your Session class does too many things:


Session management
Login
Data validation
Logout
Authentication
Inclusion management

Your class has no clean way to destroy a session.
You don't verify if a session is active.
Your constructor seems a little off. Sessions are a singleton. Use a single static final class.
You don't need to repeat public on every method;
You are storing a class on a $_SESSION. I would avoid that like plague. You should start and end the session. And you should have a method to save the session (that runs session_write_close() on shutdown or at any given time).
There's no way to check if a session was opened before or not, or if it was saved already or not.


Fixing these points and splitting your code into classes that do each thing in separate will make your code better in every conceivable way.
A while ago I've used JSON to store the session data. It generates files a bit longer, but it is faster to save. Consider making your own session management system, based out on PHP's way.
Since HDD is cheaper than CPU cycles, I would consider using such way to load/save your sessions.
Completely outside the scope of this review, you could use a RAMdisk with the /tmp partition to squeeze every tiny piece of performance you get. Use only 10% of your RAM for such purpose.



Before doing anything to store your password, I recommend a good read:
How to securely hash passwords?

One of the points is that you shouldn't use SHA1, but instead use bcrypt or password_verify (PHP5.6 and up) in the future.

Also, you should be extremely careful with SQL injection and other possible attacks, especially evolving different encodings.
I sound paranoid, and I know that. But I just want a safe code.