Replying to Php Sessions

I am not so experienced to know what facebook or google is using, but for example, as I know wordpress doesn't use sessions at all, the use GET variables for everything and a cookie for authorizing a user and they don't store anything more, but that might be old news?

Also, one of the best practice is to regenerate the session id after user logins or something like that, you can use php function:

http://php.net/manua...generate-id.php

Some other bigger products store sessions in a database of some kind or even better in memcached, but that's a different story, because that session data needs to work on different processing machines or multiple servers, but if you just have one server, a simple website, I think a simple PHP session is quite save with the regeneration of the session id is enough.

Don't use cookies yourself and use sessions, but it depends on your needs, you can always use your own session handler.

Here is some more reading about PHP sessions:

http://shiflett.org/articles/the-truth-about-sessions

And i agree with you completely.

At this point i think it would also be usefuk if you talked a little bit more about the extra and advanced techniques that big companies like facebook and google use. It might be very interesting because they have to maintain a very delicate balance betweem user security and convenience. more security could potentially mean unhappy users and.more convenience could result in unauthorized access that ciuld be gained easily..... complete nightmare

User machines can easily be compromised through social connections and cookies can be stolen from them, which eventually can be used to find out restricted information about the user. But sessions are stored on the server, and because server is a "server" and only certain individuals have direct access to it, the security cannot be compromised through social connections easily. So data on server, according to this philosophy, is more secure than data on user machine.

With the stolen cookie which has the session id you can access that session as if you were that unique user, but some security mechanisms exists, that it's not so easy to give cookies away and use it for others to use the same session, cookie is nothing more than a http header information. But of course, as I said, it's more secure to store data on the server and only the id to that data on the user computer rather than all the data in different cookies.

because cookies can be stolen. IF a cookie can be stolen, so a session can be stolen too,

I am not an expert PHP developer, nor do I have much knowledge about server side stuff. But I remember one tutorial about php sessions and cookies where the demonstrator mentioned somewhat similar stuff. What I learnt from that tutorial was that cookies reside on the user computer while sessions on the server. And this very fact makes sessions a little bit more secure than the cookies. User machines can easily be compromised through social connections and cookies can be stolen from them, which eventually can be used to find out restricted information about the user. But sessions are stored on the server, and because server is a "server" and only certain individuals have direct access to it, the security cannot be compromised through social connections easily. So data on server, according to this philosophy, is more secure than data on user machine.

There might be another side of the picture. Servers are prone to more hacker attaches than user machines because they are always connected to lots of people from different parts of the world and the connection is available 24x7. On the other hand, getting backdoor access to a user machine might be extremely difficult if the user does have some knowlege of internet security.

So the eventual fact remains that nothing in the digital world is safe and everything has a vulnerability that can be exploited.

Sessions are stored on the server, every "user" which gets a session on a server, gets a unique identification on the browser, usually in a form of a cookie.

So for sessions to work, you need cookies which stores your session id.

PHP sessions are safe, but not as safe as some implementations of user login systems in some products, which use some extra things, but I guess it's much better to start a session and use it for authentication, but for example if you want to make the user be able to stay logged on for a year, you would need to create your own cookie with some kind of identification to that user, like a hashed username and password with salt and maybe even an ip address, it depends what you want, because cookies can be stolen. IF a cookie can be stolen, so a session can be stolen too, but in my opinion for most things PHP sessions are enough.

To store information in a session in my opinion is much better than storing everything in a lot of cookies on the client browser which can be spoofed and usually you store information in a cookie with information which isn't very important or in a one way hash which you can only check, but not read and show.

@yordan, the quote you had from my previous post has really bad english. I need to think about this as well...

If this is right then I think I have to seriously think about what I was actually doing the session is file is stored on the server and the cookie file is stored on the user machine.

I would say that a session is a process, or a thread, rather than a file. A file could be helpful for that purpose, for instance a socket, but I associate a session to a process rather than to a file.

PHP sessions work by putting a cookie on your computer with which it identifies you, when you start a session with PHP, you send a cookie for the sessions to identify you and select the correct session which is stored in the server sessions folder, that session will expire depending on the cookie.

If this is right then I think I have to seriously think about what I was actually doing when I was appearingly listening to the PHP tutorials. My thought on session and cookies was that the session is file is stored on the server and the cookie file is stored on the user machine. For your discussion, I guess my knowledge was incomplete. The session file do exist on server but a cookie is needed for it as well. I hope I get it this time correctly.

If cookies are disabled on the browser, PHP use PHPSESID and put it in all the links in your site, whenever you click a link, you also click the session id parameter in the URL and from that string, the PHP sessions identifies you, it's really a quite bad practice, because you can give that link to someone else and it identifies it as if it was you, which is quite a security risk, that is why usually in sessions, the encrypted string encrypts your ip address and checks it, so if you use one IP and the person who spoofed your data and got the cookie or phpsesid won't be able to use it, because he is on a different IP.

I am unable to make a decision on which one is more secure: sessions or cookies? Can you please talk about this a bit more....... I have heard (or read) somewhere that sessions are more secure than the cookies because the file that has most of the information resides on the server and thus access to the file is limited. On the ohter hand, because the cookie file resides on the user machine, access to it is relatively easier and the chances of leaking out of secret information are much greater.
What do you have to say about this?

I think sessions are different than cookies. I am not an expert php devloper but I tend to look around for various help topics about php development. And according to my information, a cookie is stored on user machine while a session is stored on the server. That is the main difference between the two.
And this difference makes sessions more reliable and safe to be used with login type of scenarios. Cookies can be used to but I think nowadays there use has been reduced to sites that don't require high level of safety and that allow users to remain signed in for long periods of time (like many months).

I don't remember the exact place where I read it but I read that it is better to use a mix up of both. For instance one should use sessions for authentication and other safety related stuff and then cookies to allow long term login support.

PHP sessions work by putting a cookie on your computer with which it identifies you, when you start a session with PHP, you send a cookie for the sessions to identify you and select the correct session which is stored in the server sessions folder, that session will expire depending on the cookie.

If cookies are disabled on the browser, PHP use PHPSESID and put it in all the links in your site, whenever you click a link, you also click the session id parameter in the URL and from that string, the PHP sessions identifies you, it's really a quite bad practice, because you can give that link to someone else and it identifies it as if it was you, which is quite a security risk, that is why usually in sessions, the encrypted string encrypts your ip address and checks it, so if you use one IP and the person who spoofed your data and got the cookie or phpsesid won't be able to use it, because he is on a different IP.

But that is also annoying, because Today, people use laptops, or mobile devices, they have a changing IP, once they use the Internet in the university, after few hours they use it at home and etc. their IP is changing and they always need to login, because of that all the frameworks have a quite secure mechanism which makes your sessions quite save and that is how you need to use it, PHP sessions algorithm is also using something like that, but when you create your custom login with sending a cookie, you don't use these algorithms if you don't know about them, so be careful.

Isn't this simply a cookie on your PC ? The age of this cookie says the age of your session?

I think sessions are different than cookies. I am not an expert php devloper but I tend to look around for various help topics about php development. And according to my information, a cookie is stored on user machine while a session is stored on the server. That is the main difference between the two.
And this difference makes sessions more reliable and safe to be used with login type of scenarios. Cookies can be used to but I think nowadays there use has been reduced to sites that don't require high level of safety and that allow users to remain signed in for long periods of time (like many months).

I don't remember the exact place where I read it but I read that it is better to use a mix up of both. For instance one should use sessions for authentication and other safety related stuff and then cookies to allow long term login support.