Best practices to store login Information

Question

How do you guys store login information?

Probably, store logged status at session. And username at cookies. But what are the safest practices to protect such crucial information, from falling into wrong hands.

Answer 1

Store the username as well in a session variable. Sessions are stored on the server, with only an identification number in a cookie.

If you need to protect the session number as well, encrypt the HTTP connection using HTTPS/SSL. This will however require you to buy a SSL certificate from an approved issuer.

Answer 2

Do not store the username in a cookie if you use it for identification. Because cookies are a client side storage and can be manipulated. Store it in the session instead that is a server side storage.

Normally, when authentication was successful, you store the user identification information in the session and only pass the session ID to the client. With that the user information stays protected on the server side.

Answer 3

If you're storing login information you need to take steps to avoid session hijacking. Store the session id in your database along with things like the users IP and browser useragent string and check that things match each time.

If you're storing passwords too then look at hashing them first - usually with some basic obfuscation like salting them first to avoid rainbow table attacks.

Answer 4

Store the user ID in a session variable; if you need to cache stuff like permission level, store that there too. Store the session ID in a cookie; use HttpOnly. If security/privacy is very important, use SSL for everything (and use an SSL-only cookie; also, have a look at the Strict-Transport-Security header, soon to be usable in Firefox). Otherwise, it is preferable to send at least the login through SSL. (Unfortunately, SSL requires a certificate from a provider trusted by mainstream browsers, which might be expensive to obtain.) Make sure a new session is started at login to prevent session fixation.

Use a salted hash to store passwords; preferably something slow like Blowfish, or SHA-256 repeated a few thousand times. (If you need your code to be extremely portable or run on old versions of PHP, MD5/SHA1 is fine too, but it will make ignorant people complain that you are using a hash that has been "broken".)