User ID, session data and security

[eluser]WanWizard[/eluser]
Ok, so not THAT secure... :coolsmile:

If you're only concern is cookie hijacking, know that CI tries to mitigate that by adding the user's IP and User Agent string in the cookie, together with the session ID and a timestamp.
The cookie payload then gets encrypted (make sure you set a good and random encryption key in your session config!).
Also, CI by default rotates the session ID every 5 minutes.

So, you can hijack a session if:
- your PC has the same IP address are the one you stole the cookie from (or you're able to fake that)
- you use exactly the same browser (or you know the exact user agent string and fake it)
- use it to attack within the session ID rotation time left
or if you can crack the encryption, guess someone elses session id, and construct your own cookie.

In short, a lot safer than some other session inplementations, including PHP's own session management.

As for cheap certificates, see http://www.whichssl.com/comparisons/price.html

p.s. and you can trust the other applications? Because if one of those gets hacked, they can use it to access your database config, find the database name, userid and password, and login to your database. Only needs a few lines of PHP...