Jump to content

Archived

This topic is now archived and is closed to further replies.

JonathanAnon

Should I just use cookies?

Recommended Posts


i have a webpage set up for secure socket layer. I know want to tighten it down by using a password.
I use to use just a login and then set a cookie to say that the user had logged in, then have an isset function on the start of each page.

Is this still the best way to do things or should I use some other method?

Share this post


Link to post
Share on other sites
I would think that most authentication systems use sessions, but really, there isn't a great deal of difference. As long as your checking the values in the cookie against a database or some other data store on the server.

Share this post


Link to post
Share on other sites
Use cookies AND sessions to ensure the best security. You have
cookie_username
cookie_userid
cookie_login (username+md5(pw))

session_login
session_username
session_userid

Cookies can be edited, so you always want to make your code refer to the SESSION variables, NOT the cookies. You want to check on each page that the cookie login and username MATCH the session login and username.

If the session doesn't exist, you get the info from the database using the cookie info and set the session.

Otherwise, someone can change their cookie to whatever they want and if you don't verify it against the session, they'll get in.

Share this post


Link to post
Share on other sites

×

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.