On shared hosting, we had occasional problems when the server's /tmp
directory was full. Our hosting company suggested we change the session save path to be unique for each site.
ini_set('session.save_path', DOCUMENT_ROOT . '/_SESSIONS/');
Yes, that puts our sessions in the web root. We deal with potential privacy issues by including a .htacces
file in that folder:
deny from all
This works.
We have now moved to our own managed server. The default session save path on this server is /var/lib/php/session
. Is there any good reason to continue overwriting this to /var/www/vhosts/example.net/httpdocs/_SESSIONS/
?