Session module

by 3 replies
4
#programming #module #session
  • You'll have to activate SSL. Then, the session data will be encrypted and sent over SSL.. This way, the session will be viewed only by the user who create that session.
    • [1] reply
    • That's not realy true. all session data but the session id should be data stored server side not client side. that would just encrypt data between the browser and the server it would not really provide more security for sessions. never print stuff that's in a session to a user except like seting a session id cookie.

      1. option to protect session data is to encrypt session the data you could use the users ip address as the key. theres problems with this and advantages also. It wont matter as much if the session data is gotten as the person would have to brute force the unknown key.
  • I have previously kept encrypted data (using my custom algorithm) in the session which I decoded (on server side) before using/reading it. So, even if anyone sees my session data they wouldn't understand a thing without my algo.
Join the discussion

Next Topics on Trending Feed

  • 4

    Session module

    The session module cannot guarantee that the information we store in a session is only viewed by the user who created the session. We need to take additional measures to actively protect the integrity of the session,What are they??