PHP Security-session data exposure

Session data exposure

Session data often contains some personal information and other sensitive data. For this reason, the exposure of session data is a matter of general concern. In general, the scope of exposure is not very large, because session data is stored in the server environment, not in the database or the file system. As a result, session data is naturally not publicly exposed.

Using SSL is a particularly effective means of minimizing the exposure to data when it is transmitted between the server and the client. This is important for applications that transmit sensitive data. SSL provides a layer of protection over HTTP so that all data in HTTP requests and responses is protected.

If you are concerned about the security of the session data store itself, you can encrypt the session data so that the contents of it cannot be read without the correct key. This is very easy to do in PHP, just use Session_set_save_handler () and write your own session to encrypt the storage and decrypt the read processing functions. For an issue with encrypting session data save area, see Appendix C.

The above is the PHP security-session data exposure content, more relevant content please pay attention to topic.alibabacloud.com (www.php.cn)!

