How can I integrate and store sessions in my database, as opposed to storing them in a cookie and file system?

Question

I've never worked with sessions in a database before, and I'm a little unclear on how they work. I have a user class already designed which stores user information: username, password, email etc. I also have a session class which uses the user ID to store a session cookie in the user's browser so that when they return to the application, a method is invoked to check if:

isset($_SESSION['id']){ $this->userId=$_SESSION['id']}

then take the user to the admin page. I've been reading that using the database is a more secure method of handling sessions, but I'm having a hard time wrapping my head around this concept. So say I wanted to store the session info in the database, and have access to that info so that if the user clicked on a link to their profile page, for example, I could use the session info to get their user info. How could I achieve this? Does it even make sense to use this approach?

Answer 1

Sessions are based on the session identifier, a string that uniquely identifies a browser session via a cookie¹ set on the client when session_start() is called. Since they are based on cookies, you should treat them as user input and you should never absolutely trust user input. Cookies can be stolen via XSS, and PHP cookies are not encrypted by default.

Sessions are stored in the %TEMP% directory, whichever that may be for your system. The save location can be changed from the session.save_path directive or by the session_save_path during runtime, but on a typical hosting environment², it's generally considered easier to gain access to the filesystem than a database.

The various security concerns are addressed on the manual:

The session module cannot guarantee that the information you store in a session is only viewed by the user who created the session.

...

Assess the importance of the data carried by your sessions and deploy additional protections -- this usually comes at a price, reduced convenience for the user.

...

The session module cannot guarantee that the information you store in a session is only viewed by the user who created the session.

Session fixation is the commonly quoted buzzword, you can find a little more info on the Session Fixation Vulnerability in Web-based Applications article that's referenced on the manual.

The session_set_save_handler() function allows you to transparently choose where sessions are saved:

session_set_save_handler() sets the user-level session storage functions which are used for storing and retrieving data associated with a session. This is most useful when a storage method other than those supplied by PHP sessions is preferred. i.e. Storing the session data in a local database.

After you build and set your handler, you can continue using sessions as usual. There are quite a few examples on the comments to the manual page on storing sessions to a database. Storing sessions in a database has an important disadvantage: if for any reason the database goes awol, then you've lost everything you've built around sessions too.

_{¹ You can propagate the session id via a URL parameter, but that's more trouble than it's worth.}

_{² By typical I mean cheap shared hosting.}