I've been reading up on managing a PHP based login system.
I came across this stackoverflow thread where the question is interestingly presented.
The answer as well provides a link to another thread that basically explains how this can be achieved using the session id and a cookie with an encrypted random token.
Answer Excerpt:
The short answer is that you shouldn't do that. For reasons why, please see this answer.
As far as what to do instead, I would set a signed cookie (that post shows how) with a large random string unique for each user. Then, when loading the session if it is new, check for the cookie. Then look up the user based on that random string. If you find one, silently log the user back in.
This is a pretty standard remember-me function, but it avoids the pitfals of having long-running sessions, or using the session identifier for other things.
One thing to note, you really should be rotating your session identifier pretty often as well. I typically do it for every login/logout event as well as whenever the user does something sensitive (admin forms, posting content, etc). There's nothing wrong with rotating too much...
Comments
Post a Comment