Tamper-proof sessions

[Colin McKinnon]

Hi all,

I want some data generated and stored at authentication which will be
accessible throughout a (web) session. However I want better security
controls than just storing it within the session - anyone who can write a
PHP script on the server can then modify the contents.

There doesn't seem to be any easy way of seperating the privilege (so e.g. a
setuid program might write the data to a file, not writable by the
webserver user). I don't want to have to run a second webserver as a
different user just to acheive this.

Anybody any ideas?

TIA,

Colin

[Chung Leong]

Re: Tamper-proof sessions

"Colin McKinnon" <colin.deleteth is@andthis.mms3 .com> wrote in message
news:cbc4on$fmf $1$8302bc10@new s.demon.co.uk.. .[color=blue]
> Hi all,
>
> I want some data generated and stored at authentication which will be
> accessible throughout a (web) session. However I want better security
> controls than just storing it within the session - anyone who can write a
> PHP script on the server can then modify the contents.
>
> There doesn't seem to be any easy way of seperating the privilege (so e.g.[/color]
a[color=blue]
> setuid program might write the data to a file, not writable by the
> webserver user). I don't want to have to run a second webserver as a
> different user just to acheive this.
>
> Anybody any ideas?[/color]

That's some of the instances where storing the session data in the database
makes sense. Encrypting the session data is another option (provided that
you have a way of protecting the key).

See help on session_set_sav e_handler() for more info.