RE: [PHP] session security for authentication

I'm confused as to why you even use the $admin check. Isn't passing the session variable enough? I thought PHP checked to see if the Session variable was valid, if not it assigns a new one and if so, it uses that session id. I'm probably just being retarded right now, but I don't see how the $admin check makes this any more secure. I always rely on passing just the session variable for security and never the username and password once the initial login is through. And to check session variables, I use session_is_registered("variable") rather than testing the value of a variable. What I am doing might not be a very good method and if it isn't I hope people let me know about it. Jason Stechschulte jpstech@nc.edu > Is there anything wrong with authenticating people using > thier session id > and a session variable? > > For example a function authenticate() would: > > 1.check a username and password against a database value, if > they match, the user gets a session > > 2. session_register is used to set a session variable '$admin' to '1' > > > on subsequent page requests, > > 1. '$admin' is set to '0' > > 2. Then session_start is called overwriting $admin= '0' with > $admin='1' (assuming they are authentic) > > 3. The existance of '$admin' = '1' is checked, if true they are > authenticated. > > Assuming no one gets hold of another persons session id this is secure > right? > > Is'nt this (effectively setting a tempory password) more > secure than using a cookie, which would send the users password > and name to the server every page request, making it more likely to > be captured? Did anyone ever respond to the above? I'm curious about this as well... Chris -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net For additional commands, e-mail: php-general-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net