I need to do some encryptions in the Private zone of my website and I want to use bcrypt with user's password.
Is it safe to store the password in the session when user does the login, so that I can use it later? Thank you
Don't store the password in the session variables. Instead, use a surrogate key.
When the user logs in, you do the following:
If an attacker gets read access to session data stored in your
If you want to use PHP securely, you should have the Suoshin Hardened PHP patch installed. (Any hosting company worth dealing with will already have it on their servers). This patch includes functionality that encrypts the session data automatically, which should be sufficient to protect you from certain kinds of attack.
But session hacks are just one item in a hackers' toolbox, and passwords are a primary target, so they should not be treated as something your program should hang on to (even in memory) for the any amount of time; a password should be hashed as soon as possible after input and the password string itself cleared immediately.
So my answer to your question would be no, you shouldn't be considering holding onto a password for re-use later.