Sessions - SSL

[cjliu42]

Hi All,

I need some advice about working with sessions in a SSL environment. I am planning to setup a session variable containing a credit_no, that would be accessed from various HTML pages. Are there any security risks or am I secure as long as the pages are within the https directory?

Thanks

Colin

[liquidchild]

what do you mean by credit number, the users credit card number? If this is the case and Iam not fully up on SSL I would suggest against storing anyones credit card details. You might wish to consider storing them using encryption. Why do they require to be passed about anyway?

[cjliu42]

Yes, when i say credit_no, i do mean credit card no. However, I think you have slightly misunderstood my question. I am planning to store the CC number in a session variable. I am developing a simple payment system, the variable need to be passed across so the user can take a look at their purchase and payment details before making a confirmation of the order. I can pass it through the forms, but this will increase implementation time and it's not very efficient.

Thanks

Colin