The contents of that session on the server are unencrypted, correct? Depending on what the secret is, he may or may not want to use it. For instance, that is probably a terrible place to put credit card numbers temporarily. -- Ryan Lane

On 9/23/10 2:24 PM, Ryan Lane wrote: Good point, but in this case I'm just storing the path to a temporary file. The file isn't even sensitive data; it's just a user-uploaded media file for which the user has not yet selected a license, although we anticipate they will in a few minutes. -- Neil Kandalgaonkar ( ) <neilk(a)wikimedia.org>

On 24/09/10 10:00, Marco Schuster wrote: It's deleted on request shutdown. -- Tim Starling

On 2010-09-24, Dmitriy Sintsov wrote: Session data is not stored in cookies, only a unique session identifier is passed to the client. Robert

Neil: Yes. Tim Starling wrote: If the file is not moved away, there's no point in storing its path in $_SESSION as it won't be available on next request (it could be used for parameter passing in globals but that's not proper style). If the file is moved somewhere else, then you need to garbage collect it in case the upload is never finished. A find -delete from cron removing files other than a couple of days could be enough. It would be nice to be able to attach delete handlers to memcached keys for the cases when there's "something more" that needs deleting (this is the same problem we also had with the temp dbs for selenium tests).