What path to register for upload_tmp_dir?

Question

linux

For security reasons, many sources recommend
setting a specific directory on the server in php.ini open_basedir, for example:
open_basedir = /var/www/
and placing temporary files outside this directory so that client sessions cannot be intercepted, for example:
upload_tmp_dir = /var/php_session I'm a
little confused on this question, is it worth doing this, and if so, why do I see errors in the logs, with messages like:
upload_tmp_dir temporary files should be placed inside open_basedir.
And if this is the case, then it makes no sense to specify upload_tmp_dir and open_basedir.
If it’s impossible to prescribe this way, then why do multiple sources write this nonsense?
Log line example,domain name changed to fake .
2019/01/16 10:43:18 [error] 1822#0: *3233 FastCGI sent in stderr: "PHP message: PHP Warning: file_exists(): open_basedir restriction in effect. File(/var/php_session/php3HjuuI) is not within the allowed path(s): (/var/www/) in /var/www/mysite.com/www/wp-includes/functions.php on line 2297" while reading response header from upstream, client: 192.168. 5.1, server: mysite.com, request: "POST /wp-admin/async-upload.php HTTP/2.0", upstream: "fastcgi://unix:/var/run/php7-fpm.sock:", host : "mysite.com", referrer: " https://mysite.com/wp-admin/upload.php "

Answer 1

you don’t have to worry.
Firstly, open_basedir reduces the speed of the site, and
secondly, it is outdated and, in fact, does not affect anything
about sessions, then in general, the probability of session interception is extremely small, especially if you only have your projects on the server.
If you care about this question, then answer who updates and how often linux is updated.
How often do you update the site core?
How often do you update PHP versions?
The answer is nobody and nothing.
Therefore, if we talk about holes, then this one is much larger