Session security

[triexa]

If I wanted to store all my user info in a session rather than fetching it through MySQL on every page load, is it still safe?

I have this in htaccess:
php_value session.cookie_domain .MYDOMAIN.COM

Soo... is it stored in a session on the server or a cookie?

Basically, if I were to say $_SESSION['access_level'] = 5, is there some way they could manipulate the value and give themselves a higher access level?

[kromey]

An identifier is stored in a cookie, but everything you store in session variables ($_SESSION) is stored server side, and is "safe".

Google "session hijacking", however.

[clamcrusher]

by default, session data is stored to files. most shared webhosts have the default setup where all session files are stored in the same dir. so your session files live with the files of all the other accounts/websites on the same server. so anyone can read/write anyones session files.

consider that while maybe the owners of these other accounts on the server may not have malacious intents, security holes in thier scripts may allow someone to gain the ability to execute php code on the server. now a malacious user has access.

aside from this server side aspect, your code would need a security hole in it to allow a website visitor to change session variables. a common example would include blindly putting user supplied key/value pairs into the $_SESSION array, or allowing code to be executed.

remember that when register_globals = On,
$_SESSION['access_level'] and $access_level are essentially the same variable, so if you allowed $access_level to be assigned a value in your script, it would also change the session superglobal.

[triexa]

I do a lot of work on some pages with javascript as well.

1) Can it access the same session information or is it simply not possible?
2) Say I were to put "accountLevel = 5;" inside a <script> in my header file. This is EASILY changed through "javascript:accountLevel = 10" in the address bar. What can I do to combat this or do some other method?

[clamcrusher]

javascript can access the session id, nothing more unless you provide a means for it.