Re: Best practice, (secure), to save session data?

Path	csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!eternal-september.org!feeder.eternal-september.org!mx04.eternal-september.org!.POSTED!not-for-mail
From	Arno Welzel <usenet@arnowelzel.de>
Newsgroups	comp.lang.php
Subject	Re: Best practice, (secure), to save session data?
Date	Tue, 19 Jun 2012 08:37:17 +0200
Organization	A noiseless patient Spider
Lines	27
Message-ID	<4FE01E1D.5010903@arnowelzel.de> (permalink)
References	<a3tm2rFqr3U1@mid.individual.net> <ud3pa9xp7h.ln2@news.roaima.co.uk> <jrd3jo$4an$1@dont-email.me> <pr5ra9xa49.ln2@news.roaima.co.uk> <jrf4si$9es$1@dont-email.me> <8f0sa9xpqm.ln2@news.roaima.co.uk> <jrg5np$pas$1@dont-email.me> <b374b9xcvo.ln2@news.roaima.co.uk> <jrnukk$emr$3@dont-email.me> <pml4b9x43u.ln2@news.roaima.co.uk>
Mime-Version	1.0
Content-Type	text/plain; charset=ISO-8859-15
Content-Transfer-Encoding	7bit
Injection-Info	mx04.eternal-september.org; posting-host="0yczmRcmY8aWSlP2HmsIaw"; logging-data="4629"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18GcTE4TgKcs5+B3VWQGh+7DoQBxdP3Xgg="
User-Agent	Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20120428 Thunderbird/12.0.1
In-Reply-To	<pml4b9x43u.ln2@news.roaima.co.uk>
Cancel-Lock	sha1:EE7NKiu/KrYjIQnWFmPimWzBXu8=
Xref	csiph.com comp.lang.php:6379

Show key headers only | View raw

Chris Davies, 19.06.2012 00:12:

> Jerry Stuckle <jstucklex@attglobal.net> wrote:
>> Yes, and my point was - you don't NEED access to the encrypted data. 
>> All you need to do is send a copy of the cookie itself to log in.
> 
> At no point until my most recent did I suggest this cookie might even
> provide an authentication service. In the scenario as described it
> contains (encrypted) information, not an authentication token.

Maybe you missed the point in the OP:

"The users have 2 choices, either we 'remember' the user after they
close their browsers or not, (for up to 30 days).

We create a unique cookie id and we store/retreive the data based on
that unique id."

And "remembering a user for up to 30 days" means "if a cookie is set,
the user does not have to log in" to me.

-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

Thread

Best practice, (secure), to save session data? Simon <bad@example.com> - 2012-06-14 10:35 +0200
  Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-14 07:46 -0400
  Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-14 13:52 +0100
    Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-14 12:30 -0400
      Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-15 08:46 +0100
        Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-15 07:04 -0400
          Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-15 16:20 +0100
            Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-15 16:25 -0400
              Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-18 19:02 +0100
                Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 15:13 -0400
                Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-18 23:12 +0100
                Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 21:30 -0400
                Re: Best practice, (secure), to save session data? Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 08:37 +0200
  Re: Best practice, (secure), to save session data? Arno Welzel <usenet@arnowelzel.de> - 2012-06-15 22:44 +0200

csiph-web