Accessing session data with a session ID

Question

I've been told that it is insecure to store things such as passwords, usernames, and user ID's in cookies, and that instead you should store a sessionID in a cookie. Here's where I get lost.

My objective is to have a basic 'remember me' feature. Normally I would store user login information in a cookie, but as this is unsafe, I'm wondering what the alternative is. I understand that each time I create a session it creates a cookie which creates a unique ID, but expires when I close my browser. So how do I get access to this session information after the browser has closed?

All help is appreciated.

Answer 1

This could be a fairly steep learning curve. Have you considered using a pre-existing CMS or other solution for what you're wanting to achieve, or even a framework that might include this functionality?

For a 'remember me' feature you can send out cookies containing the user ID and a hash of that user's hashed password hashed again with some known, but secret, token. That solution doesn't allow you to remotely expire someone's login, however, without resetting someone's password.

Another approach therefore is to generate a unique token for that person's login and have another database table relating that unique token to a particular user and expiry date.

Answer 2

Possibly the best approach, as has been suggested and what most third-party apps do, is to create a "user_sessions" database table with the following fields:

session_id (var_char)
user_id (int)
ip_address (var_char)
last_logged_in (unix timestamp)

Then use a cookie to store an md5 hash of whatever you like, possibly:

md5($username.$ip); //since md5 has a lot of reverse look ups now you should use a number of fields to validate. You could use a different crypto function to make it more difficult to crack, but md5 is the simplest version available in all php versions.

EDIT: You will then compare the stored hash from the cookie with the database session_id to see if they have already logged in. The reason to combine a couple of fields in the md5 function is to create a less "guessable" hashing format. It makes it less likely someone will be able to edit a cookie and login as someone else.

This could be done for all users (this way you can track who is online) and just set a "persistant" login variable in the cookie. eg.

p_login=true || p_login=false

That way you'll know whether to auto login or force login.

note: You may be able to look at http://www.openwall.com/articles/PHP-Users-Passwords for a different way to hash passwords, session_ids and users.