Session control for authentication

[mostafatalebi]

Hello everybody

 

What is the best way to check if the user accessing a restricted page is logged in?

 

Currently, I use the following method:

 

if(isset($_SESSION['username']))

{

      // redirect to the homepage

}

else

{

// render the page

}

 

################################

 

but i think it's too simple and can easily be ripped. Isn't there any other way? For instance is it good to store the password in a session (in the time of logging in) and co-check with username session?

 

Thanks in advance

[requinix]

Since the session is stored on the server (generally) you don't have to worry about it being altered. Put the bare minimum into the session: user ID/name, access level, maybe a couple other things that you might want to know frequently. You don't have to (and shouldn't) store the password in there since it's not like you have to authenticate the user with every request.

 

Maybe you're confusing sessions with cookies? Cookies are unsafe, and while a cookie is used to locate session data the actual data itself is safe.

[mostafatalebi]

NO I'm not confusing. Your guide is useful. thanks. Maybe user ID and SESSION are good to use. thanks

[Strider64]

Go Wings! ..... Sorry I couldn't resist....