Check if user is logged in, but...

ketchapay

Hi all,

I was wondering if there's a better way than just checking if the user has successfully logged in by setting a flag to some value. I would appreciate any suggestions.

In some of the pages I wrote, I just checked if the user is logged on by checking if $user has a value:

if ($user) {
do this
} else {
do that
}

$user is actually the cookie value.

kparker

It's a great leap in security if the value of $user is some opaque value (created e.g. by md5) and that value is used to key into a session (however stored.) This makes it far harder to counterfeit the login process, because only the few active hash values (among 10^{some-very-large-factor} possibilities) are valid at any given time. Another thing I've seen done is to have the session log the IP address when created and subsequent logins only succeed when coming from that same IP. This is to prevent user X from logging in and emailing user Y the session key--such sharing of session will now only succeed if X and Y are on the same host (or router running NAT) rather than for everyone anywhere in the world.

Anon

MD5 creates a 32bit hash, it includes all letters of the alphabet, albeit only in "small" type, and numbers, you therefore have 36 different characters.

The possibilities should therefore be 32³²

= 1.5 x 10 ^ 54

or in full terms

= 1,523,249,554,100,000,000,000,000,000,000,000,000,000,000,000,000,000,000

A lot.

ketchapay

Uhm... how do I exactly implement that? =o) I'm just starting with PHP.

Anon

Check out PHP Sessions in the manual.

For light-duty use, you can just use the default storage of session info in the filesystem. Even if you aren't needing to store any information from one page to the next, the session ID itself is useful as a user validation.