That implies you're keeping such information with my session (across requests). Is that the case? I may just be misunderstanding. If so, you need to encrypt it

That implies you're keeping such information with my session (across requests). Is that the case? I may just be misunderstanding. If so, you need to encrypt it first. Storing sensitive data in the user's session is akin to writing it to disk in plaintext.