Cookies

[cheechm]

Is it safe to store a password in a cookie in this format:

 

md5(md5(password and salt))

 

Password being user inputted and salt being a random 3 character string from the database.

 

Thanks

 

If not are there other ways I should do this (to keep the session alive after browser close)

[elgoog]

You could try using sha1 for a bit more security.

 

sha1( sha1(pass-hash) . sha1(salt) )

[Garethp]

Try to avoid cookies. If you want real security, use Sessions. They are easier and are stored on the server, so users can't view or edit them. They are stored like normal variables, and are called like normal variables, you just need session_start() at the top of each page you use sessions in. Here is an example

 

Page 1:

<?php
session_start();
$_SESSION['Test'] = "Hello World";
?>

 

Page 2:

<?php
session_start();
echo $_SESSION['Test'];
?>

[cheechm]

However that doesn't allow me to keep a session for ever? (IE after browser close)

 

Thanks

[PFMaBiSmAd]

The value you store in a cookie for authentication purposes should not be a static fixed value, as would be the case if you stored anything derived from a username or password.  It should be a generic unique id that can be regenerated to help prevent it from being used by someone else to impersonate the actual visitor if someone gets a copy of it.

 

A session id is propagated between pages either as a cookie or on the end of the URL, so it suffers from the same problem if someone else gets a copy of the session id (they can impersonate the actual visitor), which is why the session_regenerate_id() function exists so that you can regularly regenerate the id.

[cheechm]

So you are saying that it is fine to store the password in the cookie like that? As it is just as likely for someone to get in via session hijacking?

 

Thanks

[The Little Guy]

In the cookie store something like this:

 

set Cookie:

$userid = 435;
$userCode = 's45jds2fo8gj';  // NOT the users password
set_cookie('myCookie',$userid.'|'.$userCode,time()+60*60*24*60000);  // Cookie for about 30 years

 

check for cookie:

if(isset($_COOKIE['myCookie'])){
    list($id,$code) = explode('|',$_COOKIE['myCookie']);
    // search for user in database
    // log the user in
}else{
    // tell the user they need to log in
}

 

NOT THE BEST WAY, NEEDS SOME WORK!