How does CodeIgniter know a cookie holds valid session data?

Question

In CodeIgniter, session data are saved in a cookie by default. But there must be also a file on my server (named as the session ID) to verify that the data (in the cookie) is valid, or am I wrong?

I'm searching for the location where the sessions are saved. I've already looked in the "session.save_path" directory (/var/lib/php5), but in this directory there are only other sessions, but not the CodeIgniter sessions.

I'm not saving the sessions in the database either, so how does CodeIgniter know that the data (in the cookie) is valid?

Solution 1

The native codeigniter installation overrides the regular PHP session handling and uses their own system of handling the data which is the reason why you are unable to find it in the normal places. (also I would mention that I personally find the way it is implemented a little insecure since ALL of your session data is stored directly in the users browser session cookie.)

You can do as Residuum has suggested and backtrack through the codeigniter session library and find where it is being stored, or you can override the session handling with something like OB_Session. (http://bleakview.orgfree.com/obsession/)

I would highly suggest that you install either OB_Session or something like it since it will then use the native PHP session handling and it will keep your cookies from either A) getting too large and crashing against the browser byte limit, or B) allowing sensitive user data to be stored client-side.

Finally, depending on what you are trying to do I would follow the CI user guide instructions and store the session data in the database. (http://codeigniter.com/user_guide/libraries/sessions.html) This would make it MUCH easier for you to work with the data and even update and extend what is stored by Codeigniter. Please keep in mind though that even if you store it in the database you STILL have to change to something like OB_Session since your cookie still holds all data even when changed to database.

Solution 2

The cookie contains an md5 hash of the session data and the encryption key of the cookie which is verified at loading the data, see system/libraries/Session.php, function sess_read() lines 140ff:

// Decrypt the cookie data
if ($this->sess_encrypt_cookie == TRUE)
{
   $session = $this->CI->encrypt->decode($session);
}
else
{
   // encryption was not used, so we need to check the md5 hash
   $hash  = substr($session, strlen($session)-32); // get last 32 chars
   $session = substr($session, 0, strlen($session)-32);
   // Does the md5 hash match?  This is to prevent manipulation of session data in userspace
   if ($hash !==  md5($session.$this->encryption_key))
   {
       log_message('error', 'The session cookie data did not match what was expected. This could be a possible hacking attempt.');
       $this->sess_destroy();
       return FALSE;
   }
}

Solution 3

This is not directly answering to your question, but I thought it might be useful to know.

Use the following to see PHP session.

print_r ($_SESSION);

Use the following to see CI session.

print_r ($this->session->userdata);

Solution 4

Just tested this today with Firebug..

To follow up on Shanee's answer, in CodeIgniter's "application/config/config.php" file, if one sets:

$config['sess_use_database'] = TRUE;

then only the default CI session data: session_id, IP_address.., is stored as a browser cookie.

Any additional custom data provided by the set_userdata() function, such as usernames and passwords, are no longer part of the cookie but are instead stored in your database.

View more solutions

Comments

[Bilal Ali Akbar]

"Please keep in mind though that even if you store it in the database you STILL have to change to something like OB_Session since your cookie still holds all data even when changed to database." - I am reasonably sure that this is no true. CI will put sessions data other than the session id in the database when enabled, not in the cookie. Well, at least in 1.7.2.

[Mazatec]

Can anyone validate Ferdy's above comment?

[Shane]

In Firefox install the 'Web Developer Toolkit' plugin and you will be able to directly view the cookies created (use the cookies dropdown). You can then check it out for yourself. I know for a fact that this was happening in 1.7.1 when I moved to OB_Session and I doubt they re-wrote the entire workings of their session class for 1.7.2. Ashley, I would suggest you check for yourself just in case either of us are wrong, but I know it caused me enough concern a year or so ago to completely dump the native CI solution. Good luck!

[Xeoncross]

Storing the data in an encrypted cookie is the way to go. No reason to waste I/O resources on sessions.

[RaduM]

Same problem here, this only happens for localhost as far as I know.

[Rob Kennedy]

You talk about where CodeIgniter stores session data and how to make it better, but I don't think you quite answered the question, which asks how CodeIgniter knows the cookie is valid. If your answer is that it doesn't know, then could you please start by saying that directly, and then move on to how to mitigate the problem?