innerworkings of PHP4 sessions?

Greetings. Can anyone explain to me (or direct me to another resource that explains) the innerworkings of PHP4 sessions? I need to know what's going on behind the scenes. For instance, when I start a session, is data stored client-side (in a cookie or query string of relative links) *and* server-side (shared memory, database, or /tmp directory)? Is there any data integrity checking? If data is only stored in one place, how am I assured that it hasn't been tampered with? How am I assured that someone just doesn't make a cookie from scratch with their own SESSID and such? What I'm guessing is that data is stored both client-side and server-side, and that all session data is checked for a particular session ID on any page that uses sessions -- and that if the data has been corrupted, the session ends or perhaps is corrected with the server-side session data. But I could be way off here. I'm trying to develop a *very* secure authentication scheme over a non-encrypted HTTP connection. There are good ways to do it with private session keys and a derivation of a message authentication code stored in the session data to ensure the session has not been spoofed. My main concern right now is whether I have to check for the session data's integrity on every session-supporting page. Dean. Administrator and Webmaster, Apt7.com Web Services http://www.apt7.com