Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm working on a client library to interface with my company's api, and we generate a user ticket when the user logs in using the api.

Obviously I don't want to send the user ticket to the client for resubmission on subsequent requests - is it (relatively) safe for me to cache this value in $_SESSION for later calls?

share|improve this question
1  
Highly depends on the implementation. $_SESSION is build around the session cookie (by default) and that's what you should protect first. Tell us a bit more on how you would approach this, as is there isn't enough info for a good answer. –  Yannis Rizos Feb 8 '12 at 16:54
    
Heh as I've been fleshing out the documentation this morning I realized that this is mostly an academic question; the only place I'm using it is in my simplified sample code, which won't be used in production. That said, my practice if I were consuming the library in production would be to mark the cookies HTTPOnly and Secure. Depending on the usage I potentially use some header comparison to reject hijacked sessions. What am I missing? –  cori Feb 8 '12 at 17:57

1 Answer 1

up vote 2 down vote accepted

I don't see why it wouldn't be. The biggest consideration that I can see is you don't want your data being clobbered by the other code that is using the session. My common practice in this instance is to create a session key of __{$company_name} and store all of my bits there. This drastically reduces the chance that some other code will nuke my session variables.

share|improve this answer
    
That's a great idea, thanks! –  cori Feb 8 '12 at 17:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.