Are PHP sessions secure in / tmp on shared hosting?

Question

I heard that this causes security problems. Would it be prudent to use pure databases for storing PHP sessions, rather than in / tmp?

Answer 1

They are unsafe (although an extension of Sukhozin can encrypt them, providing little security). Because of this, you do not need to switch to the database (although there are other good reasons for this). The easiest way is to simply install session.save_pathinto a directory that you can access.

Answer 2

If the session data contains sensitive pieces of information, it is not safe for anyone who you cannot trust to access it, of course.

- , , , .

, , , .

Answer 3

No, they can be read by your host provider if you use shared hosting, if he wants ...