Can a user change a PHP session?

Question

page1.php:

<?php session_start(); if ($_POST['password'] == "testpass") $_SESSION['authenticated'] = true; ?> 

page2.php

 <?php session_start(); if (isset($_SESSION['authenticated']) && $_SESSION['authenticated'] == true) { echo "Super secret stuff!"; } ?> 

Can a user log in without a secure password?

Answer 1

Not. The data in the $ _SESSION variable is stored on a server inaccessible to the user.

The session is connected to the user through a cookie. A cookie with an identifier (i.e., a long random string) is sent to the user to identify the user and link to his session. If someone else accesses this cookie, he can use the same code to pretend that he is a user, and thus he can log in without a password.

Answer 2

A session can only be modified from within PHP code, unlike $_POST, $_GET, $_COOKIE , etc.

As an aside, I think you can use empty() to simplify your conditional:

 <?php session_start(); if (!empty($_SESSION['authenticated']) { echo "Super secret stuff!"; } ?> 

Answer 3

A session can be changed in different cases .. See this → Session Poisoning