Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #6328

Re: Best practice, (secure), to save session data?

Show all headers | View raw

Simon <bad@example.com> wrote:
> the way I see it, if they can get the session cookie then they can
> just as well access the base64_encoded data anyway.

Almost.

1. If you put the data in the session cookie as base64 then it can be
decoded and viewed any time someone likes. No security.

2. If you encrypt the data into the cookie using a secret known only to
the website then at least someone has to go to the bother of trying to
brute force the data string, but they have as much time as they like to
do so. Password security.

3. If you put a session key in the cookie with, say, a 4 hour timeout on
the webserver side where the real data is stored, then after the timeout
has expired the session key is useless to anyone trying to obtain your
client's data. Time security.

You have to trade off password-based vs time-based security. Generally
#3 is the preferred solution.

Chris

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Best practice, (secure), to save session data? Simon <bad@example.com> - 2012-06-14 10:35 +0200
  Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-14 07:46 -0400
  Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-14 13:52 +0100
    Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-14 12:30 -0400
      Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-15 08:46 +0100
        Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-15 07:04 -0400
          Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-15 16:20 +0100
            Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-15 16:25 -0400
              Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-18 19:02 +0100
                Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 15:13 -0400
                Re: Best practice, (secure), to save session data? Chris Davies <chris-usenet@roaima.co.uk> - 2012-06-18 23:12 +0100
                Re: Best practice, (secure), to save session data? Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 21:30 -0400
                Re: Best practice, (secure), to save session data? Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 08:37 +0200
  Re: Best practice, (secure), to save session data? Arno Welzel <usenet@arnowelzel.de> - 2012-06-15 22:44 +0200

csiph-web