I need to save session data for a dynamic web page script by writing to file. I have two questions:

  1. Are there any security preferences as to whether to save the data UNDER the web folder, or OUTSIDE the web folder?

  2. I attempted to write to the folder an (unsuprisingly), I had a 'file permission refused' type error. Should I set the folder ownership to the apache user (600, 640 or 644?)


core     <- 'OUTSIDE' web folder (php script live here)
data     <- 'OUTSIDE' web folder (session data and other misc data resides here)
web      <-  web root folder
   js    <-  any folder below is 'INSIDE' the web folder

For example, in a php script (i.e. a dynamic PHP page), I can attempt to write to a file using something like fput('../data',data) yet (as I understand it) ../data should not be accessible - for security reasons.

Could someone please provide a simple example that shows how to provide access to ../data/ in the example given above?.

What are the actual SPECIFIC steps required?

BTW, I am running on a LAMP stack.

2 Answers 2


There absolutely is a security preference to save sensitive data outside of your web root. If you don't want random users being able to access the data, then don't put it under web root.

Sure, you can set the file permissions to be non-readable or configure Apache to deny access to the file or use mod_rewrite to block attempts to access the file, but these security mechanisms are much more error prone and more inconvenient than simply putting sensitive data outside of the web root. And session data definitely qualifies as sensitive data.

And what to set the folder permissions to depends on your server setup. On a standard LAMP setup, PHP will execute as the same user as Apache (often nobody). However, under shared hosting the PHP script is often run under the domain's own SFTP/shell user. But either way, you shouldn't be giving other users read access to your session data.

  • Thanks for that. It still sounds a bit confusing for me in that the php script (in the dynamic page) can access the file using something like fput('../path/to/folder',data) yet ../path/to/folder should not be accessible. Could you please demonstrate how to provide access to ../path/to/folder/ in an example?. What are the actual SPECIFIC steps required?
    – Homunculus Reticulli
    Mar 30, 2012 at 9:37
  • @Homunculus Reticulli: I'm not sure what you mean. If a file is located within the web root (the location Apache treats as the website's root directory, i.e. /) then it's obvious how that can be accessed. If it's outside of that directory, then it's not a subfolder of the web root (at least not for that domain/vhost). But if your relative path/URL (../path/to/folder) is simply relative to some PHP file in a subdirectory of web root, then the referenced folder would still be within the web root. Perhaps I've misunderstood your question? Mar 30, 2012 at 9:46
  • Please see my updated question for clarification of the terms I am using
    – Homunculus Reticulli
    Mar 30, 2012 at 9:54
  • @HomunculusReticulli: Then that would not be accessible through that vhost. However, if, say, that entire directory structure is inside of a folder htdocs and htdocs contains a bunch of different sites similarly set up; some users might have htdocs set as DocumentRoot for the main server. Then if the main server site is accessed, the user would likely be able to access your data directory. Mar 30, 2012 at 10:00

Some generalised rules about security will save you a lot of pain. Yes, it is technically possible to store updatable content within the webroot. But you need to ensure that stuff you don't want to be changed by users can't be changed by users, and that the storage of content cannot be used to host data that shouldn't be there, and that there is no direct access to the cotnent via the webserver, and that the stored data is not itself code (PHP, javascript, ssi...). Life becomes a lot simpler when you store user submitted data elsewhere. Also, making the entire contents of the webroot readonly to the webserver helps.

I had a 'file permission refused' type error. Should I set the folder ownership to the apache user (600, 640 or 644?)

This is a much more general question. I usually define a couple of groups (and make good use of the setgid flag on directories) one including site admins but excluding the webserver uid (webdev) and one with site admins and webserver uid (webdata). All files within the web root are readable by others by only writeable by webdev. The data directory (session files, some dynamic content) is writable by the webdata group. But this might not be the right model for you. Making directories/files .rwxrwxrwx should be a last resort.

Also, try not to use relative directories when referencing different parts of your site. It makes the site as a whole movable - but undermines the ability to move parts of the site easily. If you define a base url in your config then use this a prefix to paths you get the best of both worlds.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .