1

Memcached is fine for sessions as I read. But what safe? Today we have more clients on one server. Every virtual host have own session.path. This is safe to prevent read sessions from other domain. But what memcache? Is it possible read session from other virtual host? It is some documentations how PHP communicate with memc.?

1 Answer 1

2

If you can connect to memcached instance, you can easily dump all the data from it. Memcached was designed as a fast cache solution, not a secure storage for data. Some points to consider:

  • The only access control memcached has is which interface it will listen to
  • You don't have any authentication - whoever connects to it gets the data
  • The memcache protocol is very simple, you don't have any kind of encryption (no SSL, for example)

Resuming: whoever have access to memcached server, have access to all data in it.

PHP has two extensions to talk with memcached server: memcache and memcached. For details you have to check their documentation (or source code), but none of them encrypts the data before sending it to server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .