What is $_SESSION and how do i secure SESSION name in PHP

Question

my SESSION starts after sucessesfull login and i really don't know how safe is my SESSION value

My SESSION value is user name and here is my code

<?php
require_once('includes/config.php');
if ($user->is_logged_in()) {
    header('Location: signup.php');
}
if (isset($_POST['submit'])) {
    $username = filter_input(INPUT_POST, 'username');
    $password = filter_input(INPUT_POST, 'password');
    if ($user->login($username, $password)) {
        $_SESSION['username'] = $username;
        header('Location: index.php');
        exit;
    } else {
        $error[] = 'Wrong username or password or your account has not been activated.';
    }
}
?>

Here is my function

private function get_user_hash($username){  
        try {
            $stmt = $this->_db->prepare('SELECT password FROM members WHERE username = :username AND active="Yes" ');
            $stmt->execute(array('username' => $username));
            $row = $stmt->fetch();
            return $row['password'];
        } catch(PDOException $e) {
            echo '<p class="bg-danger">'.$e->getMessage().'</p>';
        }
    }
    public function login($username,$password){
        $hashed = $this->get_user_hash($username);
        if($this->password_verify($password,$hashed) == 1){
            $_SESSION['loggedin'] = true;
            return true;
        }   
    }

Now i need to know how safe is my $_SESSION

and how do i secure my $_SESSION value

Answer 1

First, it is valuable to have a deeper understanding of how sessions work in PHP. When you run session_start() , PHP registers an ID for the current visitor and allows you to start storing/receiving information linked to the session ID, for example:

session_start(); // Registered visitor ID on server "B3D4IUC86"
$_SESSION['password'] = "test1234"; // Stores password for visitor "B3D4IUC86"
echo $_SESSION['password']; // Retrieves 'password' index for visitor "B3D4IUC86"

It is best practice not to store secure/unencrypted data directly on the user's machine as this data can be intercepted in transfer or accessed directly. Rather, store an ID which you can lookup on your machine(s) and find the information internally. This will also (slightly) increase network transfer speeds as you are not transferring all data, but only a simple ID which you can lookup.