RE: [PHP] custom session management and authentication

You are correct. There is a cookie stored on the client. It should be harder to guess the authentication token based only size. Also, since you have control over the secret key, you can rotate it which could thwart someone that had guessed your algorithm and time and key and was attempting a brute force attack. However, like Jaime stated, if someone gets your cookies...game over =) Brad On Thu, 2002-10-24 at 11:36, Ford, Mike [LSS] wrote: > > -----Original Message----- > > From: Brad Pauly [mailto:brad@robinsontech.com] > > Sent: 24 October 2002 16:57 > > > > On Thu, 2002-10-24 at 09:38, Jaime Bozza wrote: > > > > > > Isn't this pretty much exactly the same as PHP4's session > > support? PHP > > > > It certainly could be. I came to PHP from ColdFusion where I started > > doing this because I wanted more control over sessions and I > > think this > > method is more secure. It worked well, so I did it with PHP > > too. I will > > need to read up some more, but the big benefit is in the way client > > authentication works. The session id is not stored on the > > client. It is > > retrieved from the authentication token. This makes it more > > difficult to > > guess a session id. > > Huh? I don't understand. You must have something client side, whether a > cookie or something in the URL, to identify the session to use for that > client, even if indirectly -- how is this *not* a session id? *If* someone > can guess a valid value of this "authentication token"/session ID, they can > hijack a session. It seems just as likely that they could guess your > "authentication token" as they could PHP's lots-of-random-characters session > ID -- or am I missing something? > > Actually, in a flash of inspiration I think I see that I am missing a step > -- I'm just not sure what it is! Please explain so I can see if I was > getting even close...!! > > Cheers! > > Mike > > --------------------------------------------------------------------- > Mike Ford, Electronic Information Services Adviser, > Learning Support Services, Learning & Information Services, > JG125, James Graham Building, Leeds Metropolitan University, > Beckett Park, LEEDS, LS6 3QS, United Kingdom > Email: m.ford@lmu.ac.uk > Tel: +44 113 283 2600 extn 4730 Fax: +44 113 283 3211 > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > >