title: TOR hidden service: PHP sessions
body: <p>If someone was making a <strong>TOR</strong> hidden service using <strong>PHP</strong>, <strong>Apache</strong>, and <strong>MySQL</strong>, would <strong>sessions</strong> have to be done differently?</p>
  
  <p>Considering that many different users could be coming from the same IP address (using the same exit node), how does that change things?</p>
  
  <p>Should I rely on setting client-side <strong>cookies</strong> that expire after a certain time period once logged in? Should I be checking <strong>cookies</strong> to see if they are logged in instead of <strong>$_SESSION</strong>?</p>
  
  <p>I have searched high &amp; low on here and Google and can't seem to find anyone else asking this question.</p>
  
  <p>I have read the <strong>TOR</strong> documents on configuring a hidden service, how <strong>TOR</strong> works, etc.</p>