RE: [PHP] custom session management and authentication

> It certainly could be. I came to PHP from ColdFusion where I > started doing this because I wanted more control over > sessions and I think this method is more secure. It worked > well, so I did it with PHP too. I will need to read up some > more, but the big benefit is in the way client authentication > works. The session id is not stored on the client. It is > retrieved from the authentication token. This makes it more > difficult to guess a session id. ColdFusion's session support was horrible. I'm not sure if they fixed it in recent versions, but I wrote my own session code there as well. I can certainly understand your issues. :) Ok, so the authentication token is stored in the cookie. What's stopping someone else from sending the same authentication token? > I don't quite understand what you mean about the security > being lost because the client side needs to know about it. > The client knowing is implicit to maintaining state. However, > like I said above, the session id is not stored on the > client. Did I misunderstand you? Ok, then. How is the authentication token stored. Is it generated on the client side, or is it stored in a cookie that is sent each time? > Nope, I am not using the built-in session support. =) It > sounds like it would be easy to do the same thing on top of > the built-in support. I do like knowing exactly what is > happening, but maybe I will look into trying it that way. Coming from CF, I'm sure you were just used to doing it in a way that worked correctly (or even at all!), but take a look at the built-in support. You may be surprised. Jaime Bozza