Can users change session variables?

Question

Or are they only managed by the server? For example, can we always assume that Auth.User.Id always matches the current user?

Answer 1

Session variables are always stored and protected on the server. When using at least the default implementation of PHP. So yes, as long as it is installed correctly.

Only a unique identifier identifying the session is sent to the client.