Alex Rivera | Logout

CodeIgniter sessions vs PHP sessions

Asked 2010-01-05T11:06:19.867
44

I'm relatively new to CodeIgniter and am making my first CI project in which there are user-accounts, etc. In the past, I have always used PHP's $_SESSION variable to this end. However, CI seems to have its own session mechanism, which it claims is "better"

CI's session mechanism seems to store all the data in a cookie? Personally I like the idea of all the data being stored on the server, accessed with a cookie-key like PHPs native session mechanism... Am I being dumb thinking that's better? Should I just accept CI's mechanism? Or should I go ahead and use native PHP sessions?

What do you guys do?

Thanks,
Mala

php codeigniter session
Edit
Report

2 Answers

34

In my experience with CI I've encountered some anomalies with its sessions, but for most day-to-day needs the library is good and easy to work with. As it was pointed out, Flashdata is a very nice feature.

If you choose to stay with CI's sessions, I'd strongly suggest to store sessions in a database and, additionally, encrypt cookies:

$config['sess_encrypt_cookie'] = TRUE;
$config['sess_use_database']   = TRUE;
$config['sess_table_name']     = 'sessions';

The database structure should be as follows:

CREATE TABLE IF NOT EXISTS  `sessions` (
    session_id varchar(40) DEFAULT '0' NOT NULL,
    ip_address varchar(16) DEFAULT '0' NOT NULL,
    user_agent varchar(50) NOT NULL,
    last_activity int(10) unsigned DEFAULT 0 NOT NULL,
    user_data text NOT NULL,
    PRIMARY KEY (session_id)
);
answered 2010-01-05T12:45:51.407
1

I know this is an older post, but I feel it is worth sharing what I have found.

Since CI uses a cookie based approach ( even with database storage ) it causes a problem for my particular app which serves data to remote clients requesting data through curl. The bottom line is Cookies and Cross Site Scripting, although manageable, do not play well together.

I chose to try to override the native Session.php class provided by CI with my own MY_Session.php. I was happy to find this wasn't too difficult, but was surprised to find that CI was regenerating session id even though my script explicitly provided them.

According to the CI manual

The user's unique Session ID (this is a statistically random string with very strong entropy, hashed with MD5 for portability, and regenerated (by default) every five minutes)

Although I can probably find a way to override this, I am wondering if it wouldn't be much easier to revert back to PHP sessions.

Just food for thought if you're going to use CI.

answered 2013-05-07T12:02:06.983

Your Answer