2 added 14 characters in body
source | link

No. Generally, session data is only stored server-side and should not be readable by an attacker.

However, bad configurations or vulnerabilities in your code may lead to the disclosure of session content. Reading out the session content is likely not the most severe problem in these cases though.

Reading Session Data from a File

Session data is stored in the file system of the server (the location is determined by session.save_path). So anyone who can read files from the session directory can read session content. This may happen if:

  • you have a directory traversal vulnerability which allows the reading of files.
  • on badly configured shared hosts, the temporary directory that stores the sessions may be accessible by others.
  • you badly misconfigured your server, and session.save_path is publicly accessible
  • ...

Reading Session Data from $_SESSION

If an attacker can read variables, they can also read their $_SESSION global variable.

This will mainly happen when you have a code execution vulnerability, so you have other things to worry about then.

But one could imagine code that makes it possible to read out variables, a simple example may be print_r($$_GET['x']);.

No. Generally, session data is only stored server-side and should not be readable by an attacker.

However, bad configurations or vulnerabilities in your code may lead to the disclosure of session content. Reading out the session content is likely not the most severe problem in these cases though.

Reading Session Data from a File

Session data is stored in the file system of the server (the location is determined by session.save_path). So anyone who can read files from the session directory can read session content. This may happen if:

  • you have a directory traversal vulnerability which allows the reading of files.
  • on badly configured shared hosts, the temporary directory that stores the sessions may be accessible by others.
  • you badly misconfigured your server, and session.save_path is publicly accessible
  • ...

Reading Session Data from $_SESSION

If an attacker can read variables, they can also read their $_SESSION global variable.

This will mainly happen when you have a code execution, so you have other things to worry about then.

But one could imagine code that makes it possible to read out variables, a simple example may be print_r($$_GET['x']);.

No. Generally, session data is only stored server-side and should not be readable by an attacker.

However, bad configurations or vulnerabilities in your code may lead to the disclosure of session content. Reading out the session content is likely not the most severe problem in these cases though.

Reading Session Data from a File

Session data is stored in the file system of the server (the location is determined by session.save_path). So anyone who can read files from the session directory can read session content. This may happen if:

  • you have a directory traversal vulnerability which allows the reading of files.
  • on badly configured shared hosts, the temporary directory that stores the sessions may be accessible by others.
  • you badly misconfigured your server, and session.save_path is publicly accessible
  • ...

Reading Session Data from $_SESSION

If an attacker can read variables, they can also read their $_SESSION global variable.

This will mainly happen when you have a code execution vulnerability, so you have other things to worry about then.

But one could imagine code that makes it possible to read out variables, a simple example may be print_r($$_GET['x']);.

1
source | link

No. Generally, session data is only stored server-side and should not be readable by an attacker.

However, bad configurations or vulnerabilities in your code may lead to the disclosure of session content. Reading out the session content is likely not the most severe problem in these cases though.

Reading Session Data from a File

Session data is stored in the file system of the server (the location is determined by session.save_path). So anyone who can read files from the session directory can read session content. This may happen if:

  • you have a directory traversal vulnerability which allows the reading of files.
  • on badly configured shared hosts, the temporary directory that stores the sessions may be accessible by others.
  • you badly misconfigured your server, and session.save_path is publicly accessible
  • ...

Reading Session Data from $_SESSION

If an attacker can read variables, they can also read their $_SESSION global variable.

This will mainly happen when you have a code execution, so you have other things to worry about then.

But one could imagine code that makes it possible to read out variables, a simple example may be print_r($$_GET['x']);.