I have made a login function for a website I am developing. If the "remember me" checkbox is ticked, then it will set a cookie. The value of the cookie is the ID of the user, so when logged in, it checks the database for the ID and compares it with the cookie's value, if a match it will display the information for that person... but I'm thinking that's not the best way?
I have the Firefox add-on "Web Developer" and with the cookies function. I had no cookie set, so only the form appears, then I went to add a cookie, added the name and gave it the value '1' which is the ID of the 1 user I have in the database. I refreshed the page and I was logged in, without filling out the form... so that's why I think using just a cookie with the user's ID is not safe.
I thought about perhaps also making another cookie with say a random 16 digit number as the value, it could be my "user key" and when I attempt a login, I check that the user id and the user key match the same user, if so, login.
Maybe perhaps keep a cookie of the username and password (which would be heavily encrypted) and compare it that way?
Does anyone agree that my first method is poor and maybe perhaps you have a better method? If you could share, I'd like to see.
Thanks.
- Chris.
0
Login, Cookies, Security
Started by .CJ, Aug 22 2007 02:23 PM
2 replies to this topic
#2 _*Creative Insanity_*
-
- Guests
Posted 22 August 2007 - 02:38 PM
I have just finished doing a registration and login function with the help of others here with security of md5() and cookies.
The cookie I was doing your way also and it sorta worked and I could also clear the cookie with a logout. But I found instead that a better was was to set the cookie with a session of the users name rather than the users ID. I have no idea why, but for me that way seemed to work better.
The cookie I was doing your way also and it sorta worked and I could also clear the cookie with a logout. But I found instead that a better was was to set the cookie with a session of the users name rather than the users ID. I have no idea why, but for me that way seemed to work better.
#3
-
- Members
-
- 970 posts
P2L Jedi
- Gender:Male
- Location:A strange world where water falls out of the sky... for no reason.
- Interests:Graphic Design, Coding, Splinter Cell, Cats
Posted 22 August 2007 - 05:09 PM
Ya, you need to do a combination of cookies with sessions. The sessions are technically the more secure part, while the cookie is mostly the convenience. I say technically because sessions aren't 100% safe in themselves really, with the whole session hi-jacking scenario and such.
Just be sure to encrypt and validate any information, and if you need more out of it, you can always study how major software such as IPB or PHPBB (probably be easier since its open source), and see how you can make it all dafer.
Just be sure to encrypt and validate any information, and if you need more out of it, you can always study how major software such as IPB or PHPBB (probably be easier since its open source), and see how you can make it all dafer.
1 user(s) are reading this topic
0 members, 1 guests, 0 anonymous users
