authentication

[Anon]

I have been looking at the code (see column) for secure authentication.

As far as I can see, two cookies are set, one with the username, one with a hash of the username and the hidden var.

My idea is that it's quite easy to copy those cookies from one computer to another if you want to login as somebody else... no need for paswoords, usernames or something else... just 1 minute access to someones computer and you are in ...

Where am I wrong?!? This is not "secure" at all?!?

[Anon]

when a user logs out, the cookies on the client machine are deleted, or expired.

whenever a cookie is accesed you can check the expire date on it.

but, yes if the user is not logged out or the session is not destroyed, then i think you can copy the cookie over and try it. i have never tried this, but sounds it might work, unless we have some kind of machine_number registered on the cookie, so it only works from the computer it was created on.

this is the reason, i myself dont use cookies or sessions till now. they are not very, or shall i say 100% reliable if you are dealing with sensitive data.

[Anon]

I use a session of 15 minutes. Cookie expires after 15 minutes. But what happens if you change the experiation time of the cookie (can you?). Yep, would be possible to keep it after you had copied it...

Unless you verify against a database, I don't see how it can be safe!