Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #6379

Re: Best practice, (secure), to save session data?

From Arno Welzel <usenet@arnowelzel.de>
Newsgroups comp.lang.php
Subject Re: Best practice, (secure), to save session data?
Date 2012-06-19 08:37 +0200
Organization A noiseless patient Spider
Message-ID <4FE01E1D.5010903@arnowelzel.de> (permalink)
References (5 earlier) <8f0sa9xpqm.ln2@news.roaima.co.uk> <jrg5np$pas$1@dont-email.me> <b374b9xcvo.ln2@news.roaima.co.uk> <jrnukk$emr$3@dont-email.me> <pml4b9x43u.ln2@news.roaima.co.uk>

Show all headers | View raw

Chris Davies, 19.06.2012 00:12:

> Jerry Stuckle <jstucklex@attglobal.net> wrote:
>> Yes, and my point was - you don't NEED access to the encrypted data. 
>> All you need to do is send a copy of the cookie itself to log in.
> 
> At no point until my most recent did I suggest this cookie might even
> provide an authentication service. In the scenario as described it
> contains (encrypted) information, not an authentication token.

Maybe you missed the point in the OP:

"The users have 2 choices, either we 'remember' the user after they
close their browsers or not, (for up to 30 days).

We create a unique cookie id and we store/retreive the data based on
that unique id."

And "remembering a user for up to 30 days" means "if a cookie is set,
the user does not have to log in" to me.



-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Best practice, (secure), to save session data? Simon <bad@example.com> - 2012-06-14 10:35 +0200
  Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-14 07:46 -0400
  Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-14 13:52 +0100
    Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-14 12:30 -0400
      Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-15 08:46 +0100
        Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-15 07:04 -0400
          Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-15 16:20 +0100
            Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-15 16:25 -0400
              Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-18 19:02 +0100
                Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 15:13 -0400
                Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-18 23:12 +0100
                Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 21:30 -0400
                Re: Best practice, (secure), to save session data? Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 08:37 +0200
  Re: Best practice, (secure), to save session data? Arno Welzel <usenet@arnowelzel.de> - 2012-06-15 22:44 +0200

csiph-web