When setting users' preferences, is it best to use cookies as to session? (PHP)

Question

For each user, I want to allow them to choose their preferences, such as which categories to show on their profile, which tags they want to see, etc. Would cookies be better than sessions because they don't expire when users logoff?

Answer 1

Cookies can have an expiration date. If there is no sensitive data in them then they're fine to use, however if you're storing thing like user id's, etc. that will be used in queries you're best off using sessions as they're stored on the server where people can't manually get at them.

Answer 2

What is the point of using cookies when the user has logged off??? User needs to be using the website in order to read from the cookie and apply the settings. Once the user has logged in, you may query the database and store the options in sessions until the user has logged off.

My recommendation is that it's best that you use sessions as they are much safer.

Answer 3

Cookies are nice because they can last between visits or "sessions". However they are also user editable and readable globally. Storing sensitive data like a login, password, session id, etc can lead to a malicious site hijacking the session or users information. Also a crafty user could alter the cookie to change the privilege level or user who is logged in and impersonate them.

Sessions are very secure because they are stored server side away from the prying eyes of users and other web sites. They do have the limitation that anything that's stored in them disappears once the session ends.

When I do login systems I prefer to use a sessions. You can pull the user from the database and then load various user defined settings into the session.

Answer 4

I think the best solution is to mix cookies and database - the last one for logged in users.

Cookies are fine, because the user doesn't have to log in on your website to have some preferences saved. But if somebody will login to your page than you got ability to save his preferences in more stable source - server database. Then these preferences are available from every computer and won't disappear after "browser cleaning".

EDIT:

Don't use sessions - they are worse than both, cookies-based and database-based solution.

Why sessions aren't a good idea? First of all they rely on cookies (session id which required for proper work of sessions system is stored in cookie called SID/SESSID/SESSIONID (in most cases)) so whenever you clean cookies you also lose your session. Moreover session are available only for few minutes (from first page load to browser close or about 20 minutes of inactivity on website) while cookies may be available for few months or even years!

So how should you do that?

There are two scenarios:

1. When user is not logged in:
   Then when he change some preference store it just in cookie

2. When user is logged in:
   Then when he change some preference just save it in database:

   INSERT INTO preference (user_id, key, value) VALUES (?, ?, ?)
   ON DUPLICATE KEY UPDATE value = ?;
   

   That's example for MySQL but you can do this the same in others RDBMS.

And how do you get final preferences?

// That's VERY unsafe code... you HAVE TO do necessary validation (this is only an example)
$preferences = unserialize($_COOKIES['preferences']); 

if (/* user is logged in */) {
    $databasesPrederences = result_of_query('SELECT key, value FROM preference WHERE user_id = ?');
    $preferences = array_merge($preferences, $databasesPrederences);
}

Sumary

This solution gives you the most stable way for handling user preferences for both logged and not logged in users.

Answer 5

You generally have three choices of where to save user preferences:

• database
• cookies
• session

When deciding between these, each solution offers different behaviors in terms of:

• persistence
• locality (tied to a browser or account)
• security

If you need longer-term persistence of these value, you should put them in the database. If you want them to not require a sign in, then cookies are a better choice. There really is no one right answer-- it depends on what you're trying to accomplish.