Reading the tutorial here: https://github.com/defuse/php-encryption/blob/master/docs/Tutorial.md (scenario #2)

It is advised to store the encryption key in a session variable. I was wondering, is it safer to store the key in a cookie variable instead?

My assumption:

• $_SESSION is stored in the server
• $_COOKIE is stored in the client's device (browser)

Threat model:

• Against employees of hosting provider snooping data
• Against hackers (they will likely attack the server instead of a user's device)

Reading the tutorial here: https://github.com/defuse/php-encryption/blob/master/docs/Tutorial.md (scenario #2)

It is advised to store the encryption key in a session variable. I was wondering, is it safer to store the key in a cookie variable instead?

My assumption:

• $_SESSION is stored in the server
• $_COOKIE is stored in the client's device (browser)

Threat model:

• Against employees of hosting provider snooping data
• Against hackers (they will likely attack the server instead of a user's device)

Update:

Notes for clarification in comments for @SteffenUllrich. Below are the exact quotes in the tutorial.

SteffenUllrich: "Where the encrypted data are located..."

Alice wants to host Dave's web application, including its database, on her server

SteffenUllrich: "recommendation regarding storing the key in the session.."

save the Key object somewhere safe (like temporary memory-backed session storage)

Reading the tutorial here: https://github.com/defuse/php-encryption/blob/master/docs/Tutorial.md (scenario #2)

It is advised to store the encryption key in a session variable. I was wondering, is it safer to store the key in a cookie variable instead?

Thread model:

• Against employees of hosting provider snooping data
• Against hackers (they will likely attack the server instead of a user's personal computer)

Reading the tutorial here: https://github.com/defuse/php-encryption/blob/master/docs/Tutorial.md (scenario #2)

It is advised to store the encryption key in a session variable. I was wondering, is it safer to store the key in a cookie variable instead?

My assumption:

• $_SESSION is stored in the server
• $_COOKIE is stored in the client's device (browser)

Threat model:

• Against employees of hosting provider snooping data
• Against hackers (they will likely attack the server instead of a user's device)