3raser Posted March 4, 2012 Share Posted March 4, 2012 I was told that my login page could easily be manipulated to set themselves as my username (Mod Justin), giving them powers. How can I further secure my website's use of cookies? I just visited your site as you - Mod Justin, simply by setting a 'user' cookie for your domain with your username in it. Your login code is NOT effective at stopping anyone or any bot script from impersonating any of the users, even impersonating you. My login code: http://pastebin.com/cBLybGKq Any possible solution to this? Link to comment https://forums.phpfreaks.com/topic/258224-securing-a-cookie/ Share on other sites More sharing options...
Monkuar Posted March 4, 2012 Share Posted March 4, 2012 make the cookie hash match with the password in the db for the user Link to comment https://forums.phpfreaks.com/topic/258224-securing-a-cookie/#findComment-1323651 Share on other sites More sharing options...
3raser Posted March 4, 2012 Author Share Posted March 4, 2012 So I would change the "name" part of the cookie, not the value, correct? Link to comment https://forums.phpfreaks.com/topic/258224-securing-a-cookie/#findComment-1323653 Share on other sites More sharing options...
Pikachu2000 Posted March 4, 2012 Share Posted March 4, 2012 No. Do not store a password, not even a hashed password, in a cookie. Link to comment https://forums.phpfreaks.com/topic/258224-securing-a-cookie/#findComment-1323656 Share on other sites More sharing options...
3raser Posted March 4, 2012 Author Share Posted March 4, 2012 Well, then can you possibly tell me what I should do then? :/ Link to comment https://forums.phpfreaks.com/topic/258224-securing-a-cookie/#findComment-1323659 Share on other sites More sharing options...
PFMaBiSmAd Posted March 4, 2012 Share Posted March 4, 2012 In your previous thread about your site being hacked/login code, someone provided a specific keyword/member search on the forum that would give you information on how to secure the login/remember-me cookie. Did you read through the replies in your previous thread? Link to comment https://forums.phpfreaks.com/topic/258224-securing-a-cookie/#findComment-1323660 Share on other sites More sharing options...
3raser Posted March 4, 2012 Author Share Posted March 4, 2012 Ah, sorry about that. I completely forgot. If you could close/delete this thread, that'd be wonderful. I have replied to the other thread responding to every post I didn't answer. Link to comment https://forums.phpfreaks.com/topic/258224-securing-a-cookie/#findComment-1323667 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.