3

The documentation for session handling in ninjaFramework states:

[...] Ninja uses so called client-side sessions. The cookie itself stores the information you want to attach to that session. [...] Ninja sessions are not encrypted by default. Therefore you should not store any critical information. Storing a user id, or username is fine

What makes storing the userId "fine"? The way I understood this client-side-sessions are basicly a cookie with attributes in clean text.

What prevents an attacker from just changing it's usersId in the session and therefore becoming another user (without logging in) to the server?

Improve this question

1 Answer 1

Reset to default
3

While unencrypted, Ninja sessions are signed:

A Ninja session is a hash of key/values, signed but not encrypted by default (see next section to enable encryption). That means that as long as your secret is safe, it is not possible for a third-party to forge sessions.

So integrity is ensured for the sessions. The warning you quoted is talking about confidentiality.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .