Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>You are really asking two questions, one about SSL and one about sessions - so, here's two answers:</p> <p>Sessions work by giving the user a cookie and storing a list of the session variables on the server. In PHP, that cookie is named PHPSESSID by default. You can probably see a lot of them if you look at the cookies in your browser right now. The value of that cookie will be a bunch of hard-to-guess gibberish characters. When you set a session variable, say $_SESSION['username']='kevin', the "username=kevin" part is stored on the server.</p> <p>If the attacker can guess or obtain that cookie, they can install it on their browser and become "kevin," unless you have other countermeasures. But, for the user to change their session to someone else, they would have to hack your server to change the session files there. The name "kevin" is never sent to the user. </p> <p>SSL is not a magic security solution, but if you are concerned about a malicious user viewing or taking over another user's session, it's probably worth the investment.</p> <p>An Internet cafe is a simple example. Lots of people gather and use the WiFi. Web pages are going through the air everywhere - even though your own body. It's trivial for an attacker to also capture the web pages of other users - this includes their session token. It's so easy, that there's a program called FireSheep that made becoming another user point-and-click simple for many web sites.</p> <p>SSL protects those web pages, and the session cookie, so that only the server and the authorized user can read them. An attacker can still capture the data going through the air, but it is just gibberish to them. </p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload