3

I have created a registration/login system for my members area. Once the user has logged in I want to store a session variable that I can use to retrieve data associated to the user from the database.

Should I in encrypt the variable in any way? The data I want as a variable will either be the username or the id, which is best?

Should session ids be regenerated in anyway and when??

hairynuggets
  • 3,191
  • 22
  • 55
  • 90
  • Session data is kept on the server and is never visible to or accessible by a user unless you provide an interface for it. The only thing stored in the client by default is the session's ID string in a cookie. – Marc B Oct 20 '11 at 19:46

4 Answers4

1

Data storage in session is considered to be "safe", so you dont need encrypt-decrypt it.

Aurimas Ličkus
  • 9,886
  • 4
  • 24
  • 26
0

Session IDs are stored like a cookie on the client's machine, and are passed back to the server for every single request. This is how PHP determines what information to load into a session once it receives the request.

Since sessions live on the server and not on the client, you only need to worry about session hijacking in regards to whether the information stored in them is secure or not. The answer to your question is no, I would not try to encrypt the information that is stored in session.

Community
  • 1
  • 1
Jeff Lambert
  • 24,395
  • 4
  • 69
  • 96
0

You should regenerate your session id after a successful login/logout. For security reasons, I would reccomend to ask the user for his password if he want's to perform a critical action (changing important data, deleting account or submit an order for example).

As AurimasL stated, you don't have to worry about session data on the server side. I reccomend this reading, if you are on a shared host, because then there are some security aspects: http://phpsec.org/projects/guide/5.html

mAu
  • 2,020
  • 1
  • 14
  • 27
0

Just an add in the comments bellow,

Keep in mind that creating a sessions are expensive for your server app. Sometimes is a good idea stores the id in the session and other informations in cookies (informations that dont need security as the username).

Felipe Pelá
  • 171
  • 3
  • 13
  • This cost in storing data in a persistent store such as MySQL can be circumvented by implementing a cache layer (memcached or tokyo tyrant for example) and in which to store session data. – Mike Purcell Oct 20 '11 at 19:40