Do I need to query the database to verify logged in status when user views private pages?

Question

.. Or is it enough to just check for a session variable that indicates a successful login has in fact been performed?

What are different ways to go about this? The ideal and not so ideal?

Thanks!

Answer 1

Third alternative: HMAC-ed cookie. No need to hit database/session-store at all.

Details.

Answer 2

Even if a user has an active session that is restores via cookie for example, you need to verify his account data.

If you don't check the current database entries for a user, he could possibly login although his profile has been banned or something like that.

The reverse situation can happen if your user opens a session in one browser (at home for example), upgrades his account to some "premium" (or whatever) account with another session (maybe from his office). When he returns home, he would get his old session that has no "premium" privileges.

So, always check the data for your user profiles. I would recommend to check them on EVERY request to your website. Your session data should only say WHO the user is and not WHAT he is allowed to do.