Session save path - What does it do please ?

[rustwood]

Sorry if this is a dumb question.

I've recently had problems with intermittent failures to log in to admin. I get the 'there was a security problem with your login' message.

My service provider's engineer has made some changes for me but did query the fact that I had an incorrect path (to a non existent directory) in my sessions /session directory.

As far as I know I've never changed this previously, so assume that it has made no difference in the past ?? (I have though, now corrected the setting to a 'correct' path)

Therefore my dumb question.

Please can someone tell me what exactly should be being saved in this folder. What is it's purpose and should I know about it.
Many thanks

[DrByte]

The default configuration of Zen Cart is to store session data in the database, since this allows sessions to work on both SSL and non-SSL pages most easily.
Another optional configuration is to store session data in files on your server, in a folder that's writable by PHP. When you do that, PHP must store a file for EVERY visitor to your site. This session file keeps track of all the settings the visitor has invoked including where they're at on the site and what's in their shopping cart, even what currency they selected. When they're done on your site, or after a timeout period, those files are normally automatically removed by PHP.

If your site is set to store sessions in files but the folder where you've told it to store those files is not writable or doesn't exist, then sessions can't start and logins and shopping can't happen.

Also, if unauthorized persons gain access to those sessions files then you open yourself up to a security risk. So, if you're going to continue using files for session storage, make sure the folder is secured properly and not accessible by web visitors.