On shared hosting, we had occasional problems when the server's
/tmp directory was full. Our hosting company suggested we change the session save path to be unique for each site.
ini_set('session.save_path', DOCUMENT_ROOT . '/_SESSIONS/');
Yes, that puts our sessions in the web root. We deal with potential privacy issues by including a
.htacces file in that folder:
deny from all
We have now moved to our own managed server. The default session save path on this server is
/var/lib/php/session. Is there any good reason to continue overwriting this to