Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #6325

Best practice, (secure), to save session data?

Show all headers | View raw

Hi,

We have a site where many users can login/logout, (giving them access to 
their personal information).

The users have 2 choices, either we 'remember' the user after they close 
their browsers or not, (for up to 30 days).

We create a unique cookie id and we store/retreive the data based on 
that unique id.

But that means a read + a write every single time any user hits the 
site. I realise that it is a very small operation with a tiny amount of 
overhead, but I wonder if it is the 'best' solution.

It was suggested that I base64_encode/base64_decode the data as a cookie 
but I am not sure about the security implications of doing that, (the 
way I see it, if they can get the session cookie then they can just as 
well access the base64_encoded data anyway).

We have an https site, but we also allow login/access via http.

Any tutorial/reading material/suggestions on how I can store logged in 
users credentials.

Thanks

Simon

Back to comp.lang.php | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Best practice, (secure), to save session data? Simon <bad@example.com> - 2012-06-14 10:35 +0200
  Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-14 07:46 -0400
  Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-14 13:52 +0100
    Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-14 12:30 -0400
      Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-15 08:46 +0100
        Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-15 07:04 -0400
          Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-15 16:20 +0100
            Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-15 16:25 -0400
              Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-18 19:02 +0100
                Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 15:13 -0400
                Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-18 23:12 +0100
                Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 21:30 -0400
                Re: Best practice, (secure), to save session data? Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 08:37 +0200
  Re: Best practice, (secure), to save session data? Arno Welzel <usenet@arnowelzel.de> - 2012-06-15 22:44 +0200

csiph-web