PHP $_SESSION Variables

Question

I am using PHP $_SESSION variables with the login workflow of my website and I just wanted to make some clarifications. Much like Facebook, I want to store a secret code only known by the server which is used to sign each request that is sent to and from the server. My initial approach was to generate a random string and store that inside of a MySQL table, but then I learned about session variables. I know that session variables by default work by using cookies that store session names and id, correct? None of the actual data is stored on the user's computer? So if I wanted to implement:

# assume that $rand_string is not null and a string
session_start();
$_SESSION['secret'] = $rand_string;

there would not be any way for the user to decode the session cookies and determine the actual value of $rand_string, right? Just want to make sure the data is secure, otherwise I will revert back to the less smooth MySQL technique. I just like the thought of the easily accessed and managed session variables.

Answer 1

Session data is stored server-side.

Cookie data is stored client-side.

Answer 2

I would prefer doing the random stuff by generating a guid` function, because it will generate a unique identifier and will be more secure than a simple random:

# assume that $rand_string is not null and a string
session_start();
$_SESSION['secret'] = com_create_guid();

And yes, $_SESSION variables are stored on server side.