I need to do some encryptions in the private zone of my website and I want to
bcrypt the user's password.
Is it safe to store the password in the session when user does the login, so that I can use it later?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Don't store the password in the session variables. Instead, use a surrogate key.
When the user logs in, you do the following:
If an attacker gets read access to session data stored in your
/tmp directory, they might extract surrogate keys. However, they will not be able to get at the user's password. Whilst this doesn't protect the data you're encrypting on the server, it does prevent unauthorised access to the user's account, and stops the attacker from exploiting cases where the user has used the same password elsewhere.
If you want to use PHP securely, you should have the Suoshin Hardened PHP patch installed. (Any hosting company worth dealing with will already have it on their servers). This patch includes functionality that encrypts the session data automatically, which should be sufficient to protect you from certain kinds of attack.
But session hacks are just one item in a hackers' toolbox, and passwords are a primary target, so they should not be treated as something your program should hang on to (even in memory) for the any amount of time; a password should be hashed as soon as possible after input and the password string itself cleared immediately.
So my answer to your question would be no, you shouldn't be considering holding onto a password for re-use later.