1

I'm working on a project that keeps some user information (non-sensitive) in a php session. As it is my first time working with sessions, I never bothered to pass any Session ID, but it still works - is that right ? I couldn't find any information about that.

I'm using some parts of the information in the $_SESSION variable to navigate and influence some of the sites' behaviour, and it sometimes is crucial for the page to interact with the user. Meaning without the correct informatin of the current session the navigation will be broken.

So, can I rely on the existence of Sessions ? And can I rely on the server to automatically pick the right session without passing the SID ?

I'm working only on one server and I don't need the session to be restorable (meaning that when a user leaves the application the session can be destroyed).

2
  • 1
    When you say "without passing the SID" do you mean not passing it in the URL? Typically if you use the function session_start() before outputting any other information then the session will first attempt to see if there is a cookie set with the SID. If the cookie isn't already there then a cookie with the SID is stored in the browser so you don't have to pass the SID in the URL.
    – JRSofty
    Nov 22, 2011 at 10:02
  • @JRSofty Basically I mean that I do nothing ;) So yeah I don't pass it in the URL, but I do not create a cookie either. Didn't know that the browser does that automatically with session_start(). So, what happens when cookies are turned off in the users browser ?
    – Anonymous
    Nov 22, 2011 at 10:20

2 Answers 2

2

If you couldn't find information about that, you probably skipped the most obvious reference: the official PHP manual. It's right there in the Introduction of the Sessions chapter:

Session support in PHP consists of a way to preserve certain data across subsequent accesses. This enables you to build more customized applications and increase the appeal of your web site.

A visitor accessing your web site is assigned a unique id, the so-called session id. This is either stored in a cookie on the user side or is propagated in the URL.

If your question is whether cookies are reliable for this purpose, in fact it's the de-facto standard nowadays. You'll hardly find PHP-powered sites that still transmit the session ID in the URL. The reason is that it's a problematic technique: it's too easy to give away your session ID. If you copy the URL and send a link to a friend or post it in a forum it's very easy that any stranger is able to access your private data, even inadvertently (you don't need a malicious guy here) if they visit the site before the session has expired and the site does not implement further verifications (which is the usual situation).

2

Yes you can rely to having the server to pick the correct sessions for you. I have in my 10 years of php coding not experienced a faulty session yet.

However, if you choose to pass the sessionid to the next page, be ware of the risks. Session hijacking is a very serious business if you have any sort of private data.

4
  • If that's the correct answer, it's just the answer I wanted to hear - thank you! :)
    – Anonymous
    Nov 22, 2011 at 9:56
  • Just tried to proof JRSoftys claim and turned cookies off - seems not to work anymore. So I basically transfer the session (with a cookie) anyway - means btw there is a risk of session hijacking anyway! And obviously it's only reliable as long as cookies are turned on!
    – Anonymous
    Nov 22, 2011 at 10:23
  • 1
    there is always a risk of session hijacking, it is your job as a smart developer to minimize it by securing the session in other ways. Nov 22, 2011 at 10:25
  • 2
    There are lots of ways to secure against session hijacking. One of my favorites is to use the session_regenerate_id() function along with changing the garbage collection of PHP with a shorter time and putting my session entries in a database. Not perfect but better than out-of-the-box PHP sessions IMO.
    – JRSofty
    Nov 22, 2011 at 10:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.