What is the proper Settings for Session Validation - Magento 2.1.0-rc3

Question

ON the backend Store>Configurations>General>Web we have the "Session Validation Settings" which shows these options:

Validate REMOTE_ADDR: NO

Validate HTTP_VIA: NO

Validate HTTP_X_FORWARDED_FOR: NO

Validate HTTP_USER_AGENT: NO

Use SID on Storefront: YES

Everything came for default as it is, what is the recommended options to choose?

Thank you so much!

Answer 1

From http://docs.magento.com/m2/ce/user_guide/stores/security-session-validation.html?Highlight=Session%20Validation

1. To verify that the IP address of a request matches what is stored in the $_SESSION variable, set Validate REMOTE_ADDR to “Yes.”
2. To verify that the proxy address of an incoming request matches what is stored in the $_SESSION variable, set Validate HTTP_VIA to “Yes.”
3. To verify that the forwarded-for address of a request matches what is stored in the $_SESSION variable, set Validate HTTP_X_FORWARDED_FOR to “Yes.”
4. To verify that the browser or device that is used to access the store during a session matches what is stored in the $_SESSION variable, set Validate HTTP_USER_AGENT to “Yes.”
5. If you want a user to stay logged in while switching between stores, set Use SID on Frontend to “Yes.” If including SID with analytics, you must configure your analytics software to filter the SID from URLs, so the page visit counts are correct.

As ever it is a balance between security and convenience.

• 1&2 mean the request must come from the same ip/through the same proxy. This means an attacker can't just simply spoof the session. It also means if your customer is on a mobile device and moves from wifi to celular they also loose their session.
• 3 refers to this header https://en.wikipedia.org/wiki/X-Forwarded-For. It says that the declared originating i.p. (before any proxies) must be the same. This has the same potential issues as 1&2.
• 4 makes sure the device/browser hasn't changed. This is probably OK most of the time but is easy to spoof.
• 5 Depends on your setup.

You can see why the first 3 aren't enabled by default. I would leave it as it is.