Can't read a session

There is no reason to give write permission to /var/www/html/website and /var/www/html if only the writable and writable/session folders are to be written to.

IMHO, it is no longer even safe to store a session in a directory located in /var/www/html/*

This should either stay in the /tmp folder or allow the writable constant to be in a location that is completely inaccessible via the browser.

This goes completely against what the CIS Apache Benchmark Guidelines suggests.

https://www.tenable.com/audits/items/CIS...b02c050880

"Outside the Configured Web DocumentRoot - The directory should NOT be under the configured DocumentRoot directory as such directories are browsable by default, and might allow unintentional web read access. With web read access an attacker could upload malicious content, and then references the content in a URL exploiting the trust that users have in the website."

For Codeigniter, the Web DocumentRoot is in the public folder of the project.  That fulfills your reference.