Contents
Is it secure to store data in session?
Session is definitely more secure than hidden fields or cookies. The difference is the SESSION values are stored on the SERVER, and hidden fields and cookies are stored on the client.
Are sessions stored in the database?
A session ID is stored in a cookie. If a hacker can steal that ID, he can pretend to be someone else, because a session is identified by… it’s ID. By saving a user’s session ID, IP and agent server-side (your database for example) you can compare the data saved in the database with the client.
How are session data stored on a server?
The standard approach to this is to make sessions have a relatively short lifetime – the most common way for an attacker to gain access to the database is through obtaining backups and those sessions would be expired in that backup. If an attacker has live access to the live database, they likely don’t need sessions, so it may not be such a worry.
How is the session id sent securely to the client?
Once the user is authenticated, the server creates the Session ID and sends it to the client (user) in the form of a cookie. This cookie is then subsequently used in requests the client sends to the server to identify himself among other users.
How to encrypt session data on a server?
Encrypt session IDs and data using the database’s inbuilt encryption routines. This protects you against cases where a database backup is compromised, but won’t protect you against disk theft or an attacker with SQL access. Encrypt your session IDs and session data in the database, using a key set in a config file on the server somewhere.
How to get data to client and save server-side storage?
There are a couple of ways to handle that “non-displayed” data. For the data required on the client (but not shown to the user) a common solution is to shove it into HTML hidden tags in the View, like this: Unfortunately, to use that data from JavaScript code in your client, you’ll need to issue a jQuery call to retrieve it from the hidden element: