Question

Can the user view data saved in session? For example, if a user log-in to a website, and his user_id is saved in session, so that the user stays logged in as long as his id is available in the session. Can he view the session data? If he can view, is it bad?
Sorry if my question sounds stupid, but I have a problem which I’m trying to solve for whole day:

I’m using a flash uploader, when i send the data to another page, the flash uploader loses the data and i am unable to get the data from session, as i asked in my previous question. Since sending session_id is not solving my problem, im thinking to pass the user_id which is stored in session along with the other data, and when the back-end script gets the user_id, it stores it in the session again so that the user stays logged in.
For example, i can send the user_id with javascript (uploadify syntax):

'scriptData'     : {'uid': '<?=$this->session->userdata('uid')?>'},

and on back-end script i can get the user_id by:

$uid = $_REQUEST['sid'];
var_dump($uid);

Now since I am sending the user_id with javascript to the back-end script, the user can very easily see that his user_id is being passed. I have a doubt if its very insecure? Can the user somehow change the user id and send it (and log in as another user?) Is it possible?

The other possible way is to pass the session_id instead of user id (Which I am unable to do it yet), is sending session_id makes more secure than sending user_id?

Answer 1

You should never send user_id. That would be a huge security hole in your app, as users will be able to change it to hack into other users account.

You should send the session_id, and then do this on the server side:

<?php session_id($_GET['session_id']); ?>

This will start that session.

And yes, storing data in sessions is secure.

http://php.net/manual/en/function.session-id.php