Jump to content
Sign in to follow this  

Should a Password be stored in $_SESSION

Recommended Posts

I think the title is very clear but i have a site that has 2 user databases, one for web mail (Round cube) and one for a directory of content that the user has to be authenticated for.


I was wondering if i should throw the password in $_SESSION and authenticate web mail if the user is logged in?


Obviously i should not send that password back to the client if it be encrypted or not but i would inject the username and password into the web mail authentication handler as if the user had already filled in the form.


Due to certain circumstances i am unable to merge the user databases.


If there are any other possibilities do recommend them instead.




Share this post

Link to post
Share on other sites

Absolutely not.


Can you not add the web mail hash to your other database?


Right just had to make sure.


I'm unable to because it is Active Directory.

Share this post

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this  

  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.