OS and Software > Webmasters and Developers > Verifying login credentials via php

Verifying login credentials via php

How about this?

if(!isset($_COOKIE[validated]) || $_COOKIE[sessID] != $_SESSION[sessID]){
header("Location: http://www.disney.com");}

if I read that correctly.. on proper login they get the 'validated' cookie..

and you then check for:

1) the presence of that cookie
2) if the session id in the cookie matches the current session

is the cookie you are storing the session in an 'older' cookie or one that is also set at login time? I don't really get that logic..

if its old.. the session id will not match, if its new.. of course it will match? can you explain the logic behind it ?
--
Girls are like internet domain names, all the good ones are already taken - Unless you get one from a strange country

I dont know the difference between games and reality anymore ...I just used a shotgun on my mother and she's not respawnin

Actually, upon actually looking at my code:

if(!isset($_COOKIE[UserID]){
header("Location: /index.php?stage=login");}

reply to Roundboy

said by Roundboy:

---

Currently.. I call a function on each protected page... that function checks the database with the current user cookie, etc and returns a true or false.

if false.. the function gives a die() with my appropriate content for failure displayed. otherwise it displays normally..

---

reply to Roundboy
I think I'm doing it right, I just use php's session handling stuff.

On successful login (checked via a lookup in mysql) I start a session that has all the user's details in the session array (user, email, valid). On each page, I do something like this:

// register the session for login checking
session_register();

include 'include/common.php';

// we will be messing with headers for redirects and cookies, so NO
// OUTPUT until the end of this "if posted" statement

// verify that the user has logged in - if not, ditch
if (!check_login()) {
        print "You are not logged in or your session has timed-out, please <a hr
ef='login.php'>click here</a> to log in.";
        exit;
}

// login checker
function check_login() {
        session_register("valid");
        if ($_SESSION["valid"] == "y") {
                return "1";
        } else {
                return "0";

}

// set the cookie lifetime here
session_set_cookie_params(10800);
session_start();

right, the timeout is set in the cookie, so it relies on the browser to remove the cookie. Can the user also request a session-only cookie?

How would you remove someones active session? or session(s)? must be a delete from a table(?) on your side, right? are session rows cleaned automatically somehow by php as well or do they just accumulate but an expiry field invalidates old ones?

said by justin:

---

right, the timeout is set in the cookie, so it relies on the browser to remove the cookie. Can the user also request a session-only cookie?

---

said by justin:

---

How would you remove someones active session? or session(s)? must be a delete from a table(?) on your side, right? are session rows cleaned automatically somehow by php as well or do they just accumulate but an expiry field invalidates old ones?

---

$_SESSION['valid']="y";
$_SESSION['username']="$username";
$_SESSION['last_visit']="$last_visit";

I think (hope) those variables are stored server-side .. in the file in /tmp, not in the users cookie, which should always just be a handle..

said by justin:

---

I think (hope) those variables are stored server-side .. in the file in /tmp, not in the users cookie, which should always just be a handle..

---

if you set firebird cookie prefs to prompt, it tells you everything about the cookie including contents, IIRC

reply to sporkme
In IE you can view the contents of cookies.

reply to justin
is it really required to manually delete all sessions, cookies, etc?

I have created a system that basically:

Allows you to pick a 15 day cookie or single session login

even if you pick a cookie, the session is created from that cookie. All authenication checks work from the cookie

This was needed because cookies were expiring for people in mid session (i.e. while posting to a forum)

my 'logout' page expired all cookies and destroyed all sessions.

Now.. as I type this, I see the error in doing it this way (funny how it hits you). If the cookie is gotten by other people, you are able to login as that person.

I should in fact:

create a database table to hold login info, and store the primary key in the cookie. All cookie reads at the site check this database for it being valid? *don't* use the exire value of the cookie ?

I assume a cron job deletes old records in the background ?

This is exactly the type of info I was looking for.. 'secure' security.. i did realize that the places I learned php (phpbuilder, zend, etc) were giving the 'easiest for the masses' examples.. not good real world authentication.

keep the posts coming folks!
--
Girls are like internet domain names, all the good ones are already taken - Unless you get one from a strange country

I dont know the difference between games and reality anymore ...I just used a shotgun on my mother and she's not respawnin

reply to sporkme
you know whats really scary?

I also have a 'common.php'

and it also holds my check_login() function.

Your comment and code layout also resembles my own!

At first glance, I thought you were somehow posting my code...

reply to justin

said by justin:

---

I think (hope) those variables are stored server-side .. in the file in /tmp, not in the users cookie, which should always just be a handle..

---

reply to Roundboy
Justin, et all,

Can you reccomend any internet reading on concepts for a robust user authentication method?

It doesn't really need to be php specify, because I can code the concept as php.. but all reading I do is for very specific, custom applications and not adaptable.. orthey are basic 'user name in a cookie' solutions, which i have already, and want to avoid.

Basically.. the 'over the years' experience you have isn't ever documented by anyone..
--
Girls are like internet domain names, all the good ones are already taken - Unless you get one from a strange country

I dont know the difference between games and reality anymore ...I just used a shotgun on my mother and she's not respawnin

I found this: »cookies.lcs.mit.edu/pubs/webauth:tr.pdf

looks ok.
edit: ok I take it back, it was a very interesting read. These guys were the ones to get google to discover they were indexing and caching cookies.txt on idiots PCs and they busted the wsj.com authentication scheme and the fools at ign/snowball (not that it seems they HAD any kind of scheme, back in 2001 when the paper was written). Read it!!

yes!

this is what i was talking about.. many of the security schemes i found examples for that the 'experts' wrote were very bad.

one relied on a 'secret hash' put in a common.php file.. or hardcoded into the script..

excellent reading...

reply to justin

said by justin:

---

I think (hope) those variables are stored server-side .. in the file in /tmp, not in the users cookie, which should always just be a handle..

---

reply to Roundboy

said by Roundboy:

---

create a database table to hold login info, and store the primary key in the cookie. All cookie reads at the site check this database for it being valid? *don't* use the exire value of the cookie?

---