note 72090 added to ref.session

jmoore at sober dot dk wrote: "Note: Changing sessions to use a directory other than /tmp will be harder to find, but no more secure." This is true. I used to think that this could be solved by storing sessions in a different folder that is accessible only by apache, but the reality is that assuming you are only running a single apache server (as any shared host will), every user can command apache to retrieve that data. The best solution is to store session data in a database by writing (and informing PHP about) specific session handling functions that store the data using a private username and password that only you know. There is a good discussion of this in Essential PHP Security by Chris Shiflett (O'Reilly Books). ---- Server IP: 64.71.164.2 Probable Submitter: 68.163.192.14 ---- Manual Page -- http://www.php.net/manual/en/ref.session.php Edit -- https://master.php.net/note/edit/72090 Del: integrated -- https://master.php.net/note/delete/72090/integrated Del: useless -- https://master.php.net/note/delete/72090/useless Del: bad code -- https://master.php.net/note/delete/72090/bad+code Del: spam -- https://master.php.net/note/delete/72090/spam Del: non-english -- https://master.php.net/note/delete/72090/non-english Del: in docs -- https://master.php.net/note/delete/72090/in+docs Del: other reasons-- https://master.php.net/note/delete/72090 Reject -- https://master.php.net/note/reject/72090 Search -- https://master.php.net/manage/user-notes.php