PHP login and cookie

Question

On my PHP site, users can log in and be able to check Remember Me to set a cookie.

What should I store as a SESSION variable? Username, hashed password and user ID , or just user ID ? If I only store the user ID , would it not be possible for someone to edit SESSION and change the identifier?

How about a COOKIE ? Should I store only user ID ? As far as I know, cookies can be changed by the end user ...

Answer 1

You don't seem to have a clear vision of sessions and cookies!

No authority can modify the contents of a session other than your code (other than attacks). This way you can store everything (reasonable), for example, user id or username , which you need to access often. in cookies you must store some obfuscation information that you can find out later when it tries to access your page. therefore, based on the contents of the cookie, you can regenerate the user session (i.e. automatically log in automatically). Just note that the user MAY change the contents of the cookie, so for security this should not be anything simple, like user id .

I just give you a simple example, this is far from ideal, but not so bad! you may need to configure it according to your scenario:

here you can create cookie content as follows:

 $salt = substr (md5($password), 0, 2); $cookie = base64_encode ("$username:" . md5 ($password, $salt)); setcookie ('my-secret-cookie', $cookie); // and later to re-login user you do: $cookie = $_COOKIE['my-secret-cookie']; $content = base64_decode ($cookie); list($username, $hashed_password) = explode (':', $hash); // here you need to fetch real password from database based on username. ($password) if (md5($password, substr(md5($password), 0, 2)) == $hashed_password) { // you can consider use as logged in // do whatever you want :) } 

UPDATE:

I wrote this article that covers this concept. Hope this helps.

Answer 2

You must store the value of the random session in a cookie. You definitely should not store user information in the cookie itself. You can then check the session identifier in the cookie every time the page loads, to ensure that (a) the user must have access to this content and (b) that the session identifier is valid.

In PHP, you can use session_set_cookie_params and session_name to set cookie parameters.

Answer 3

The user cannot edit the session variable; they are managed on the server.

Session Variable Advantage
1.) Secure
2.) Reliable

Session drawback 1.) Short lifetime, until the session exists,

session

destroyed
when the user closes the browser server reboot
Session destroyed using session_destroy ();

So the session is more secure.

A cookie on the other hand allows you to remember user privileges.

If you use a combination of both, then its advantage over your code

 You can store userid and username in cookie, then verify user identity using its combination. 

If it does not exit, you can log in and save the information in the session, as well as update the cookie.