Using session class for secure logins

[eluser]jedd[/eluser]
[quote author="tokyotech" date="1255774424"]Storing sessions in a database? This is outrageous. That's an additional disk access - 1,000 times slower than RAM access of a normal session variable.[/quote]

As mentioned, it provides for session data in excess of 4KB, so the outrageous (though unsubstantiated) cost of 1000x slower performance may be worth the penalty.

Remembering that a few milliseconds is still very, very fast. And 4KB is very, very small.

Further, you're not obliged to use on-disk CI sessions. I just mentioned it was generally preferable.

Further, cookies are stored at the client end, I think. Local disk will always be faster than traversing to the client network.

Finally, in practice things are not as outrageous as you may like to believe. There are several layers of cache involved in the process - in reality it's highly unlikely that each time you retrieved some session data for your user you'd actually incur a disk access.

If you have any other misunderstandings you'd like some help with curing, let us know.