July 31, 201115 yr Hello friends, I just read in another forum where it was mentioned that using php session is not 100% secure on shared hosting or when u have other websites on the same server ? How true is that?
July 31, 201115 yr Hello friends, I just read in another forum where it was mentioned that using php session is not 100% secure on shared hosting or when u have other websites on the same server ? How true is that? Its not secure on any server, Use SSL.
July 31, 201115 yr its true, sessions are saved to the tmp folder so anyone can read the session data by reading the tmp folder
July 31, 201115 yr Shaun you just made me lol my guts up "Its not secure on any server" ok How to secure a session if your a cheap skate/skint and cant afford at least a VPS http://www.php.net/manual/en/function.session-save-path.php Use a folder in your account and hopefully your host isn’t totally stupid and set the box up right. Edited July 31, 201115 yr by SniderDK
August 1, 201115 yr Er .............. I know you can save the sessions to database and an internal folder of your choice, I should of explained more, sessions can be hijacked and sniffed, the only fool proof way I know is using SSL, If Im wrong please correct me
August 1, 201115 yr You are right, SSL Secures them between the client and the server, but the OP was specifically wanting to know about sessions on a shared hosting, where all sessions by default go in the temp folder and can be accessed by any account, then hijacked. In that instance, SSL is useless. I think you just needed to clarify what you meant
August 1, 201115 yr You are right, SSL Secures them between the client and the server, but the OP was specifically wanting to know about sessions on a shared hosting, where all sessions by default go in the temp folder and can be accessed by any account, then hijacked. In that instance, SSL is useless. I think you just needed to clarify what you meant Ahh yes, I was in a rush last night sorry, Yh they are right the most affective way is to store sessions to database using the session_set_save_handler located: http://my.php.net/session_set_save_handler, Although file is OK I personaly prefer db.
August 1, 201115 yr Shared hosting = common location for sessions. If I know this common location then if a site uses SSL or not makes no difference Yup
August 1, 201115 yr You can change the directory where the session data is stored, so problem solved (at least this one, lots of problems on shared hosting). From the manual: http://php.net/manual/en/function.session-save-path.php
August 1, 201115 yr Yes...and was linked to above by SniderDK Oooops! Sorry, I totally missed that. Should I edit the post / report it to be deleted? Edited August 1, 201115 yr by tango
Create an account or sign in to comment