4
votes
3answers
3k views

Do you need to encrypt session data?

I came across a session management class in PHP which encrypts session data in the session storage folder (i.e., /tmp) and can be decrypted later in your script using a key. I was wondering if it's ...
3
votes
1answer
2k views

Will session_regenerate_id() without true parameter improves security? Should I use it right before login?

I want to decrease session fixation attack vulnerability, hence I used session_regenerate_id() before login. Somehow I'm in dark now and not sure the right answer for questions below: When we ...