Home/ Questions/Q 6548275
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-25T11:55:55+00:00

I know that on regular shared hosting, storing PHP sessions in the default location

  • 0

I know that on regular shared hosting, storing PHP sessions in the default location (/tmp) may present security issues. A VPS does not have this issue. Therefore, I assume VPS cloud hosting does not. But what about regular cloud hosting? Is that just shared hosting over multiple computers, meaning that PHP sessions would still be vulnerable to the prying eyes of other webhosting clients on that cloud? Or is there something different about (non-VPS) cloud hosting that protects from PHP session storage location vulnerabilities?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Shared hosting simply means that your web hosting provider places multiple web sites on a single server.

    Cloud hosting uses the same concept and is in reality just another
    type of shared hosting, but with greater upwards and downwards
    scalability.

    One issue with shared hosting is that within the context of a single server, there is a fixed amount of physical space. Although the hosting provider will provision their servers in such a way that you don’t run into capacity problems, the issue still remains. Cloud hosting removes that possibility by replacing the concept of the individual physical server, with that of a virtualized and highly scalable infrastructure.

    Cloud hosting overview

    But the security is still a concern in cloud hosting. The only difference is that your files are stored in multiple servers. And you do not know and trust where the files are stored.
    So for better session handling and security I will advice you to use database to store and manage sessions for the following reasons.

    1. Only you have access to the session data.In shared hosting this can help you a lot.

    2. Each server will have its own directory where these session files are maintained, so if you are employing load balancing across multiple servers there is no guarantee that a request for an existing session will be given to the server which is maintaining the state for that session.

    3. It would be difficult for a site administrator to perform such queries as “how many sessions are currently active?” or “which users are currently logged in?”.But if you are storing in the database then you can track.

    4. The application needs to be able to run on multiple servers without server affinity.

    Here is a great article about storing sessions in database by Chris Shiflett.

    Hope it helps.

    • 0