Forum Moderators: coopster
I'm making a site that requires users to login. The data that regular users can access isn't especially sensitive. Requiring them to login is more for marketing purposes than for security. So basically, it won't be a disaster if their session ID's are sniffed and someone logs in as them.
However, there are some users that will be able to upload/edit items on the site. They will also have to login, although with a seperate php script and differently named session variables. Their info is also stored in a different MySQL table.
The site will be hosted on a shared server, which probably increases vulnerability to attack, even if I do my best to limit the access that other hosting accounts have to my files.
My question is, how paranoid should I be? If power-users only login to add things, for example, once a week (as opposed to every day for regular users) what are the chances of a hacker sniffing out their session ID and using it to attack the site? More specifically, has this ever happened to anyone on this forum?
I don't want to spend a million unnecessary hours encoding all the session ID's and assigning random keys on each request to the server, unless I absolutely have to!
Thanks in advance for your advice!
do sessions get hijacked, definitely
shared server env makes things interesting, there is always the possibility of other people on the same host accessing your files, though that really depends on the host
making sessions expire after a short period of time helps to protect them.
Obviously I didn't look properly, as this is just the info that I needed! Thanks!
