Is php session unchangeable from user end? [duplicate]

Answer 1

There is a cookie stored in the browser usually PHPSESSID which identifies which server session the user is using. If a user were able to steal it (this usually happens through XSS vulnerabilities) the user could potentially take control of another users session.

The session data itself is stored on the server and could only be modified if a user were somehow able to upload and execute a malicious script in the server

Answer 2

Yes user cannot change session Variables...

if it hacked it can changed...

you need to get user id to change the $_SESSION["website"] in your current domain and use strict validation...

Otherwise they can hack it....

Answer 3

Can the user change the session content? (for example, if user is logged in and $_SESSION["username"] is "example.com", can the user change the session $_SESSION["username"] to "example.org" to ruin another website?

No. Sessions are stored on your server thus it would be impossible to directly change the session. On the other side, it all depends on the developer and how the interprets the client requests. For example, making

$_SESSION['last_website'] = isset($_SERVER['HTTP_REFERER']) 
    ? $_SERVER['HTTP_REFERER'] 
    : $_SERVER['REQUEST_URI'];

would eventually override the $_SESSION['last_website'].

Answer 4

`$_SESSION` variables are stored in the server and hence cannot be modified by the user.

One of the best practices is that we must keep changing the session id from our end.

Thats why we use a function called session_regenerate_id().

This function that will replace the current session ID with a new one, and keep the current session information, so the use will not be logged out.

To answer your question in comment:

Whenever you start a session, server will send back a cookie which will contain the session id, the cookie name will be PHPSESSID which is the default name. You can also choose to change it. So this id is what that keeps changing when you use the session_regenerate_id function.

REASON WHY TO USE IT:

This mainly helps in preventing session fixation attacks.In this attack a malicious user will try to fix the session ID (SID) of another user. If he gets successful,the user will get all the access of the original user and will be able to do anything that the legitimate user can do.

So if you regenerate the session id the previous old session id will be no longer valid

You can get more info about session fixation IN OWASP WEBSITE

Answer 5

No, Until and unless the php code itself reveals the PHP session, which can be used to session stealing, and the session could not be changed from the user end until and unless the there is some functionality given by you yourself to change the session from the front end.

Answer 6

$_SESSION is saved in the server, so the user cannot modify it ( Except the case of session hijacking)