What to store in a session

If the user successfully enters the password and username and you want to establish a session, what data should the sessions contain? I'm pretty confused by this, I read that it should be a randomly generated string, is it possible to store a hashed user_id + salt? I want to make sure that this is really the correct user:

The form:

<form method="POST" action="">
<input type="hidden" name="auth_token" value="<?php echo $form_token; ?>">
Username: <input type="text" name="username">
Password: <input type="password" name="password">
<input type="submit" name="action" value="Login">
</form>

I want to do something like the following:

if form token in session = form_token var in form
  if username and password are correct
    set session hash(user_id + salt)

Edit: I forgot to add, most likely, it will be on shared hosting.

+3
source share
4 answers

. cookie , " " , . -, , , .

.

$_SESSION["UserAuthenticated"] = true;
$_SESSION["UserID"] = $userID;
+7

.

, .., , cookie. , .

+1

. - , , , . .

+1

, , ? , :

<?php

if ($_POST["username"] == 'test' && $_POST["password"] == 'test') {
   $_SESSION['authenticated'] = true;
}

?>
+1

Source: https://habr.com/ru/post/1782684/


All Articles