Re: Session Authentication
| From: | Tijnema ! | Date: | Mon, 09 Apr 2007 15:37:50 +0000 |
| Subject: | Re: Session Authentication | ||
| References: | 1 2 3 4 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-252333@lists.php.net to get a copy of this message | ||
On 4/9/07, Martin Marques <martin@bugs.unl.edu.ar> wrote:
Tijnema ! escribió: On 4/9/07, Martin Marques <martin@bugs.unl.edu.ar> wrote:authenticated, also storing a username? And if that's not the case, then you could authenticate by creating a cookie where it says authenticated = yes, and you're authenticated... TijnemaAnd then the user would crack the cookie .... I know they are encrypted, but trust me, cookies can be edited. So what? The user authenticated himself, so what is he gonna crack? Yes, but i guess you're not only storing if the user hasYes: Don't use transparent session id, or even better, save the authentication in a cookie on the client (seperated from the session array).