Is a session alone enough for non logged-in users to see some information?

Question

In my project I have a content type called Person that is only viewable or editable by logged-in user. In this content type, I added some fields.

I want to give a person the ability to visit his profile. So I made a module called anonymous_profile with the following code.

function anonymous_profile_menu() {
    $items = array();
    $items['anonymous-profile-login'] = array(
        'title' => t('Login'),
        'page callback' => 'drupal_get_form',
        'page arguments' => array('anonymous_profile_login_form'),
        'access arguments' => array('access anonymous person login'),
        'type' => MENU_NORMAL_ITEM,
    );

    $items['anonymous-profile'] = array(
        'title' => t('Anonymous Visit'),
        'page callback' => 'anonymous_visit_page',
        'access arguments' => array('access anonymous person login'),
    );

    $items['anonymous-profile-logout'] = array(
        'title' => t(''),
        'page callback' => 'anonymous_logout',
        'access arguments' => array('access anonymous person login'),
    );
    return $items;
}

anonymous-profile-login creates a form where users insert information in order to log in on the anonymous-profile page. anonymous-profile-logout is the logout page.

function anonymous_profile_permission() {
    return array(
        'access anonymous person login' => array(
            'title' => t('access anonymous person login'),
            'description' => t('Anonymous person login form to view profile page.'),
        ),
    );
}

This is the form object that is returned to anonymous-profile-login.

function anonymous_profile_login_form() {
    $form['field_national_id'] = array(
        '#type' => 'textfield',
        '#title' => t('National ID'),
        '#size' => 10,
        '#maxlength' => 20,
        '#required' => TRUE,
        '#description' => t('Please insert your national id'),
    );

    $form['submit'] = array(
        '#type' => 'submit',
        '#value' => t('Login'),
    );

    return $form;
}

This is the form submission handler.

function anonymous_profile_login_form_submit($form, &$form_state) {
    $national_id = $form_state['values']['field_national_id'];

    $login_result = false;
    if ($national_id == '123456') { //this is for test.in real , inserted national id must be searched in database...

        $login_result = true;
    }

    if ($login_result) {
        drupal_set_message('Login is ok');
        $_SESSION['anonymous_logged_user'] = $national_id ;
        drupal_goto("anonymous-profile");
    } else {
        drupal_set_message('Invalid login information', 'error');
    }
}

This is the logout page.

function anonymous_logout() {
    if (isset($_SESSION['anonymous_logged_user']))
        unset($_SESSION['anonymous_logged_user']);
    drupal_goto('anonymous-profile-login');
}

In anonymous_visit_page(), first I check the session anonymous_logged_user; if it is OK, I show the information to the user.

function anonymous_visit_page() {
    if (isset($_SESSION['anonymous_logged_user'])) {
        if ($_SESSION['anonymous_logged_user'] > 0) {

            $national_id = $_SESSION['anonymous_logged_user'];
            // load information from database bases on $national_id and print rendered html output.

        }
    }
    //--------------------------
    //visitor is not logged via form
    drupal_set_message('You must loggin in order to see your profile', 'error');
    drupal_goto('anonymous-profile-login');

}

Is this solution safe?
Is a session alone enough for this method, or must I increase the code safety?
Is there any possibility the session is stolen, and users access information without log in via form?

I am using Drupal 7.

Answer 1

To answer a couple of questions asked:

• Extra features to increase safety? You're tying identification/authorization together here; if I know an ID number then I'm authorized to view details associated with it. A malicious actor can just throw guesses at that field to start pulling data they shouldn't have access to. You should increase your authorization criteria (e.g. ask additional details to prove the user is who they say they are) and make the form more robust against brute-forcing (e.g. limit requests, use other bot-defeating tools, etc.).
• Can a session be stolen? Yes. A PHP session is vulernable to session hijacking if you're using unsecure transport. You should enforce an encrypted session so you can rule that out.