Is it possible to modify the $_SESSION variable?

Question

Is it possible for an malicious user to set the $_SESSION (in php) variable to any value he wants?

Answer 1

No, not if your code is correct and doesn't allow to set values based on unverified userinput.

Answer 2

Unless you have done something wrong in your code he cant set it on your server, what he can do is steal some other users session cookie and get in that way... in other words; he can change his own session cookie that your $_SESSION use to identify him

Answer 3

Yes. If you use something from a cookie or another similar request method that a user can edit to interact with the session then there is a change. For example say you make an online store and store the item id's in the cookie and on page refresh pushes it into the session. While on the page a user can edit the cookies so when it goes into the session it have been modified.

Answer 4

It depends on how you set the sessions variable. An user can exploit the way you set them.

The most common attacks with sessions is session fixation : http://en.wikipedia.org/wiki/Session_fixation

Answer 5

Highly depends on your code. Something very obvious: $_SESSION['username'] = $_REQUEST['username'].

Answer 6

If you provide a means for him to do so (bad/insecure code), it is possible. However, this is generally unlikely.