If I remember correctly, been years since i played with PHP ...

$_SESSION marker data is stored in a directory on the server, some /temp by default ... if a user can access that directory, the user can spoof the server by creating a local cookie that equals one of the markers in the server's local directory. This marker is suppose to be automatically deleted when the user ends the session (i.e. closes the browser)

That temp dir can be pointed from the default (which a user can potentially know the default location of) to one you create somewhere else on the file system ... this would make it more difficult to find if a user got access to your file system.

The markers have an obscure random filename .... bSSdwwFfwwf .. or such.

Last edited by Longshanks; 07/01/09 06:52 PM.
[Linked Image from w3.the-kgb.com][Linked Image from w3.the-kgb.com][Linked Image from w3.the-kgb.com]