Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Memcached is fine for sessions as I read. But what safe? Today we have more clients on one server. Every virtual host have own session.path. This is safe to prevent read sessions from other domain. But what memcache? Is it possible read session from other virtual host? It is some documentations how PHP communicate with memc.?

share|improve this question

1 Answer 1

If you can connect to memcached instance, you can easily dump all the data from it. Memcached was designed as a fast cache solution, not a secure storage for data. Some points to consider:

  • The only access control memcached has is which interface it will listen to
  • You don't have any authentication - whoever connects to it gets the data
  • The memcache protocol is very simple, you don't have any kind of encryption (no SSL, for example)

Resuming: whoever have access to memcached server, have access to all data in it.

PHP has two extensions to talk with memcached server: memcache and memcached. For details you have to check their documentation (or source code), but none of them encrypts the data before sending it to server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.