Ummm... for sessions, I don't know, I don't use them.
But for cookies, you'll need to have a server response to the cookie. This server response is then fetched and compared with the cookie to see if it's set.
if($cookie_hash != "" && $cookie_hash == $server_hash) {
# auth is gained - display protected page
} else {
# auth is not gained - display loginscreen
}
Obviously, you need to do the compile of the server-hash before this sentence. I usually use a combination of several values from file/db, and compile them, then md5 the result.
Each time the page is loaded the different servervalues are compiled/calculated, and if one of them fails, auth fails.
The cookie is set with a single value, done by compiling the values (after comparison of passwords), and doing the same as above.
As for the sessions, I think the $PHPSESSID is set with the client's browser-session (as well as on the server), thus assuring the uniqueness and the auth of the session.
knutm
