All geek questions in one place

Understanding the way to save a session as value and security

I use only sessions to store variables and was hoping to make sure that the session save path cannot be tampered with by any of the users. So I went to check my phpinfo and found that the session save path doesn't matter. Is this normal for users who use sessions only for variables? Do I have to worry about if the session save path is not set?

+4
source share
2 answers

The default value for session.save_path is "" (empty string), the default is /tmp .

From a “working” point of view, there is no need to worry that it does not matter (as is the default value); however, from a security point of view, there is.

Warning from the manual:

If you leave this set in a global directory, for example / tmp (by default), other users on the server can arrange sessions to obtain a list of files in this directory.

+7
source

you can set save_path by creating / editing .htaccess with these codes:

 php_value session.save_path /mnt/stor1-wc1-dfw1/123456/www.domain.com/web/sessions php_value session.save_handler files

for more information visit this site: State Servers PHP sessions on cloud sites and how to fix broken PHP sessions

0
source

Source: https://habr.com/ru/post/1437714/

More articles:


All Articles