-3

Is it safe to set the session logged_in as true if the login is correct? Will the user be able to edit this, or set their own session?

Hugh
  • 11
  • 1

3 Answers3

0

Good afternoon Hugh,

PHP session variables are stored on your server, not on the local machine. For general purposes, setting a session variable to check login is safe, but I would have an additional check to validate username and maybe even a session key.

Timothy Bomer
  • 504
  • 5
  • 21
0

Is it safe to set the session logged_in as true if the login is correct?

Yes

Will the user be able to edit this

No

or set their own session?

No, though they can hijack an existing session.

rlanvin
  • 6,057
  • 2
  • 18
  • 24
0

session it related to a user currently logged in. For a user, who wants to alter other user's session, it is a way harder thing to do then to mess around with such other user's cookies.

Given there are 2 directions to move on: cookies or sessions - sessions are generally more safe. It is also an important note here in below answers, that sessions are stored on your server, while cookies shall be kept on client, thus by nature being more vulnerable then sessions.

Zerus
  • 158
  • 15