How does CodeIgniter know a cookie holds valid session data?

Question

In CodeIgniter, session data are saved in a cookie by default. But there must be also a file on my server (named as the session ID) to verify that the data (in the cookie) i

Answer 1

The native codeigniter installation overrides the regular PHP session handling and uses their own system of handling the data which is the reason why you are unable to find it in the normal places. (also I would mention that I personally find the way it is implemented a little insecure since ALL of your session data is stored directly in the users browser session cookie.)

You can do as Residuum has suggested and backtrack through the codeigniter session library and find where it is being stored, or you can override the session handling with something like OB_Session. (http://bleakview.orgfree.com/obsession/)

I would highly suggest that you install either OB_Session or something like it since it will then use the native PHP session handling and it will keep your cookies from either A) getting too large and crashing against the browser byte limit, or B) allowing sensitive user data to be stored client-side.

Finally, depending on what you are trying to do I would follow the CI user guide instructions and store the session data in the database. (http://codeigniter.com/user_guide/libraries/sessions.html) This would make it MUCH easier for you to work with the data and even update and extend what is stored by Codeigniter. Please keep in mind though that even if you store it in the database you STILL have to change to something like OB_Session since your cookie still holds all data even when changed to database.