Question

If (for argument sake) ‘admin-access’ was granted in php with:

if (isset($_SESSION['admin']))  // this session would be set
{ // grant access; }            // after a successful login
else { //redirect ;}

Would this be a particularly easy thing to bypass and fake, if you knew what the name of the session is (in this case it is admin)?

In other words, can someone easily fake a $_SESSION, if all a script calls for is the session to be ‘set’?

Answer 1

Using isset() is not bad for security. It depends on your logic that how you use it. It will be good if you not only check isset() but also its value.

For Example:

if( isset($_SESSION['admin']) && $_SESSION['admin'] == true ) { 
  // grant access
} else { 
  //redirect 
}

Or something like this:

if( isset($_SESSION['admin']) && $_SESSION['admin'] == '1' ) { 
  // grant access
} else { 
  //redirect 
}