Have Geek Brain

Are the server sessions secure?

I am using (server side, not cookie) sessions in the application I am writing, if users have not been able to access the server, can I trust the $ _SESSION variable or check the content on every page load?





Note:
I am trying to limit the number of queries to my database and I am currently validating the data on every page load and I think I can probably eliminate the queries, but I want to be 100% sure.

+1


a source to share


2 answers


Yes, you can keep it in session safely. You must make sure the verification method is safe. (the method you use before saving in the session).



+3


a source


You just need to make sure the session is stored in a safe place. By default, sessions are stored somewhere like / tmp / on linux. If a user can access your server, they can edit session variables.



You should consider storing sessions in the database and / or adding hash checking (md5 + secret seed) to sessions and always check that session variables are not changed relative to that hash.

+2


a source






More articles:


All Articles