Re: PHP session management

> Hi,
> I noticed on a server how PHP creates files in /tmp in the form sess_XXXXXXXXX
> to store session information (of course only readable by the apache user),
> but "XXXXXXXXX" is the actual session ID. If a person has a local access to a
> system using PHP's session management, aren't they able to hijack any
> session? Am I a complete moron and am missing something?
> And that aside, are there any other known problems with using PHP sessions
> (besides all the standard PHP security issues like variable access)?

Use CGI-PHP (with suexec) in a multi-user environment. With that
configuration each user (and PHP) has it's own UID. Playing with chroot
in suexec is a plus on security and your session files might be safe.

Well, the performance .. it's working.

-boris
Received on Oct 27 2003