Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!eternal-september.org!feeder.eternal-september.org!mx04.eternal-september.org!.POSTED!not-for-mail From: Arno Welzel Newsgroups: comp.lang.php Subject: Re: Best practice, (secure), to save session data? Date: Tue, 19 Jun 2012 08:37:17 +0200 Organization: A noiseless patient Spider Lines: 27 Message-ID: <4FE01E1D.5010903@arnowelzel.de> References: <8f0sa9xpqm.ln2@news.roaima.co.uk> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: 7bit Injection-Info: mx04.eternal-september.org; posting-host="0yczmRcmY8aWSlP2HmsIaw"; logging-data="4629"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18GcTE4TgKcs5+B3VWQGh+7DoQBxdP3Xgg=" User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 In-Reply-To: Cancel-Lock: sha1:EE7NKiu/KrYjIQnWFmPimWzBXu8= Xref: csiph.com comp.lang.php:6379 Chris Davies, 19.06.2012 00:12: > Jerry Stuckle wrote: >> Yes, and my point was - you don't NEED access to the encrypted data. >> All you need to do is send a copy of the cookie itself to log in. > > At no point until my most recent did I suggest this cookie might even > provide an authentication service. In the scenario as described it > contains (encrypted) information, not an authentication token. Maybe you missed the point in the OP: "The users have 2 choices, either we 'remember' the user after they close their browsers or not, (for up to 30 days). We create a unique cookie id and we store/retreive the data based on that unique id." And "remembering a user for up to 30 days" means "if a cookie is set, the user does not have to log in" to me. -- Arno Welzel http://arnowelzel.de http://de-rec-fahrrad.de