calabiyau Posted January 5, 2007 Share Posted January 5, 2007 Hi, quick question. I have recently changed the save path of my sessions on the coding level to be one level above the root directory of my domain. I am on shared hosting and thought I read it was a bit of a security problem as anyone on your host can have access to the session id's. Was this the right thing to do to change the save path? Is it safer? Are my sessions safe in that location and is there any way they can be accessed? Quote Link to comment https://forums.phpfreaks.com/topic/33000-where-is-the-safest-place-to-store-session-ids-on-shared-hosting/ Share on other sites More sharing options...
psychohagis Posted January 5, 2007 Share Posted January 5, 2007 I dont know much about this, but I thought session ids were saved in cookies Quote Link to comment https://forums.phpfreaks.com/topic/33000-where-is-the-safest-place-to-store-session-ids-on-shared-hosting/#findComment-153646 Share on other sites More sharing options...
calabiyau Posted January 5, 2007 Author Share Posted January 5, 2007 Well they are but a matching file is saved on the host's server in a temporary directory that is common to all websites that use that host. I wanted to change it to a private directory that only I could access, but am not sure if it is secure, even though it is one level above my domain directory. Anybody know? Quote Link to comment https://forums.phpfreaks.com/topic/33000-where-is-the-safest-place-to-store-session-ids-on-shared-hosting/#findComment-153663 Share on other sites More sharing options...
wildteen88 Posted January 5, 2007 Share Posted January 5, 2007 If you are on a shared host then I would save the sessions to a private directory in your webspace. The best place would be outside of your web root (the web root is the directory in which you upload you files to). That way it is inaccessable from people browsing your website. Only you can read that directory (via FTP). Quote Link to comment https://forums.phpfreaks.com/topic/33000-where-is-the-safest-place-to-store-session-ids-on-shared-hosting/#findComment-153689 Share on other sites More sharing options...
ShogunWarrior Posted January 5, 2007 Share Posted January 5, 2007 I think the bigger problem is that through scripts or CGI a different user on the system could access someones sessions.As far as I know the most secure way would be to handle all the session calls through MySQL using session handler functions. Quote Link to comment https://forums.phpfreaks.com/topic/33000-where-is-the-safest-place-to-store-session-ids-on-shared-hosting/#findComment-153704 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.