Storing record ids in PHP sessions, in the clear?

Question

I'm needing to store a user_id value in a PHP session.

Is it OK for me to do it in the clear

$_SESSION['user_id'] = 10;

Or what methods, that are relatively easy to implement would be best for adding security? (the app doesn't contain any super critical or sensitive info like payment etc so I don't want to go over the top)

Answer 1

The $_SESSION array only exists server-side, so it's only in the clear to your code. In your example, I don't see anything to worry about.

Answer 2

The only people that can read that is you (via $_SERVER) and anyone that has access to where you store the sessions (assuming file based). This is generally /tmp/ but you can change with ini_set('session.save_path', BASE.'sessions');.

Besides, there doesn't seem to be much critical information in your example. What can a malicious user do if they know their own user id?

Answer 3

A user id (or any database primary key) isn't a particularly sensitive piece of information. It's often exposed to a user or the public, so there is extra-not-much to worry about as far as storing it in the session array.

Your system's security should not depend in any way on whether someone knows the primary key (id) for a user in your database.