title: What to store in a session?
body: <p>I know about all the issues with session fixation and hijacking. My question is really basic: I want to create an authentication system with PHP. For that, after the login, I would just store the user id in the session.</p>
  
  <p>But: I've seen some people do weird things like generating a GUID for each user and session and storing that instead of just the user id in the session. Why? </p>
  
  <p>The content of a session cannot be obtained by a client - or can it?</p>