Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


I am about to create a website which will have a registration/login area. After the user has logged in he/she will have the ability to buy one or many modules which consist of static content regarding a topic. Of course the security on these modules is important as I want to make sure only people who have bought the package have acccess to the relevent modules.


Do you think its a good idea to store the information in a session about which user has access to which package once they have logged in so I only make a single call to the database to find out.


I go to the database everytime they access a particular module to make sure they have access to that module


I do both


there is an another way I have completely missed...

Any advice will be great. I am trying to get a balance between performance and security.


share|improve this question

migrated from Dec 9 '11 at 11:34

This question came from our site for professional programmers interested in conceptual questions about software development.

If such a simple query could come even near to creating a performance problem, you would most likely get far bigger problems in other areas where you need to access serious amounts of data. – thorsten müller Dec 9 '11 at 9:03
up vote 5 down vote accepted

If you store the information in the session, it might get outdated wrt. to the database. That is, if module ownership expires, or it can be cancelled through other means, it might still be present in someone's session. Whether that's a problem or even a feature, is up to you.

However, this is "premature optimization". Unless you can prove (prove!) that this is going to be a performance problem, I wouldn't spend any more time than strictly necessary on it.

share|improve this answer
As alex said spend time on this only if hitting the database would really take you away from your performance benchmark! And if it does you need to consider updating the info in the session if the user prvlgs change because of user actions ( easy bit) and if the user privlg change because of other factors (subscription expired, system changes like rules of subscription change, any batch running on your system etc etc etc.) – Sachin Kumar Dec 9 '11 at 12:13
Thanks guys just needed to be sure =o) – Bobby Dec 9 '11 at 13:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.