[eluser]jedd[/eluser]
[quote author="modelreject" date="1255906592"]
Okay, I know people have touch on this before, but I just want to clarify something. When using CI sessions is this just a client side cookie and therefore not secure.
[/quote]
The manual clarifies this for you quite nicely - read the Session Class page:
Quote:
The Session class permits you maintain a user's "state" and track their activity while they browse your site. The Session class stores session information for each user as serialized (and optionally encrypted) data in a cookie. It can also store the session data in a database table for added security, as this permits the session ID in the user's cookie to be matched against the stored session ID. By default only the cookie is saved. If you choose to use the database option you'll need to create the session table as indicated below.
