Reading the tutorial here: https://github.com/defuse/php-encryption/blob/master/docs/Tutorial.md (scenario #2)
It is advised to store the encryption key in a session variable. I was wondering, is it safer to store the key in a cookie variable instead?
- $_SESSION is stored in the server
- $_COOKIE is stored in the client's device (browser)
- Against employees of hosting provider snooping data
- Against hackers (they will likely attack the server instead of a user's device)
Notes for clarification in comments for @SteffenUllrich. Below are the exact quotes in the tutorial.
SteffenUllrich: "Where the encrypted data are located..."
Alice wants to host Dave's web application, including its database, on her server
SteffenUllrich: "recommendation regarding storing the key in the session.."
save the Key object somewhere safe (like temporary memory-backed session storage)