Session Fixing Library

[eluser]Stratadox[/eluser]
Even if the default 'sessions' are also saved in the database, modifying the cookie modifies the session. This means anyone with access to the cookie and the means to re-encrypt it could insert their own session content - which produces unchecked user input on a very sensitive level. Not very secure.

The cookie CI uses is encrypted, but once the encryption is broken an intruder has access to all the session data.

Using this library, however, if a hacker decrypts the cookie, all they gain is the session id - something that is usually stored unencrypted. The session id alone cannot modify or even read the session data.

As for the PHP 5.4 thing, the library has a dependency on session_status which is introduced in 5.4. Using the latest PHP version is recommended whether you use this library or not.