Why is it good save to save sessions in the database?

后端 未结 6 1001
逝去的感伤
逝去的感伤 2020-12-04 11:05

I have seen that codeigniter have facility to save session values in database.
It says saving session in database is good security practice.

But I think saving

6条回答
  •  失恋的感觉
    2020-12-04 11:28

    The idea is that sessions can't be hijacked.

    A session ID is stored in a cookie. If a hacker can steal that ID, he can pretend to be someone else, because a session is identified by... it's ID.

    By saving a user's session ID, IP and agent server-side (your database for example) you can compare the data saved in the database with the client. If a hacker steals someone's session ID, the hacker just might not have a matching IP and/or user-agent, making the users not match which allows you to show or hide certain content.

    You have to compare the data manually though.

提交回复
热议问题