Question

I read this post where the author advices to store session files in a different location on our application since sessions in /tmp/ are not safe. Is this a best practice that everyone follows? How safe does putting session files into other location will make any difference?

Need your valuable advice on this.
Thank You.

Answer 1

The problem is only that if you’re on a shared host, the /tmp directory is typically shared by everybody, so other users will at least be able to list all files in the /tmp directory. They don’t typically have access to those files, but just being able to see them may already be quite a security risk. Therefore it’s better to store your temporary data elsewhere where only you have access.

This is not really of any concern if you are the master of your own server.