Premise
So I heard that session and cookies in PHP can be vulnerable (not sure if it's true). So I had this Idea if I should encrypt those in my projects (mainly the framework I am working on).
Idea
So the basic idea is to have a class of session manager. An unique APP_KEY
for the project which is automatically generated during creating the project. Now the session variables can be managed (set/get) via the class.
setting value
- Take the value and name for the session
SHA-256
hash the name after salting it withAPP_KEY
so it is unique for each project.- Encrypt the value via a cipher where the private key is that
APP_KEY
- Then put it as
$_SESSION[$hashed_key] = $encrypted_value
Getting the value
Reverse the setting process
So what'll happen is we can successfully retrieve the data only via the class else if directly retieved, it'd be just some ramndom encrypted key-value pairs.
Code
You'll find the code here
Discussion
So what what I wanna discuss are 4 points
- Is this useless?
- Is this overkill?
- Are there any place for improvement?
- Are there any concerning points?