I'm not completely sure how the modx sessions work (Evo 1.06), hence this question; I'm wanting to show information on a page based on whether or not the user is logged in to the modx backend manager. Basically, if the user is logged in to manager show X, otherwise show Y.
At present I simply check if $_SESSION['MgrValidated'] == 1, but how secure is this? I presume this open to the session var being tampered with? Is there a better alternative?
I'm thinking the session var should be checked against the sessionId in the modx_user_attributes table and perhaps also tied to an IP address somehow? Anyone have any suggestions or is this all unnecessary?
-
☆ A M B ☆
- 24,524 Posts
How would the session var get tampered with? That's done on the server, as soon as the page is requested. The cookie is sent along with the page request, and the cookie's content is only the session name, which is randomized based on the time it's first created. So PHP goes off to the session file location, and gets the user data from that file to load into the $_SESSION array.
If your session cookie and session files are not secure, then you have much bigger problems.
