title: Session hijack resulting in token exposure
body: <p>I'm trying to wrap my head around session hijacking and the use of tokens for CSRF protecting.
  I use this object method in each of my scripts to check whether a session variable is set or the token matches the session token.</p>
  
  <pre><code>public function admin_index(){
  
  session_start();
  if(!isset($_SESSION["user"]) || $_GET['token']!=$_SESSION['token']) {
      header("location: login/login_form.php");
      session_destroy();
      exit();
  }
  </code></pre>
  
  <p>I'm new at this and my question is:
  If my session id is somehow hijacked will he be able to some how also read my variable $_SESSION['token'] in the short time span after session_start and the the session data is fetched and populate in $_SESSION or is it still safe on the server? </p>
  
  <p>Are session variables generally safe even though a valid session has been obtained?</p>
  
  <p>Never mind the $_GET['token'] instead of POST. I'm still working on it.</p>
  
  <p>Thanks</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>What I'm asking is. If a token also helps me secure my sessions the way I'm using it. If every query, link or view in my script requires a valid token and an attacker only got a hold of my session_id the tokens would be another layer of protection cause he/she would need both the id AND the token to do anything in the script, right?</p>
  
  <p>And the token is secure on the server even though an attacker has acquired my session_id?</p>