Re: Security and Cookies

The practice that I have made my employees follow is to store the session name using a session ID created within the script with an MD5 hash , microtime, and user id... $id = md5($user_id . microtime()); session_start($id); session_register('user_id'); ## registers the user_id in a session file on the server This information will ensure that the key is truly random.... if the session life is 0 (dies when window is closed) there is no way it can be guessed and the odds that a user is on your site at the exact time that someone happens to guess the code is almost none.... If your sessions destroy after a time period (15 min) then a more secure way is to store the session ID in a database... though you would have to reference the database on every page to find that key.... and somehow have a way to retrieve this information (passing the database key to the URL)... it is still secure. Registering the user_id in the session ensures that the user cannot tamper with the value in a cookie... and thus avoiding the security issue... now I know that lots of other people have other tactics but this is my way.... and I have never had a problem. also, here is a good tutorial... http://www.devshed.com/Server_Side/PHP/Sessions/ hope this helps... Dallas K. CEO / Senior Programmer Bhedana Multimedia. ----- Original Message ----- From: "rodrigo" <rodrigo@shreve.net> To: "php php" <php-general@lists.php.net> Sent: Friday, January 05, 2001 10:20 PM Subject: [PHP] Security and Cookies > How secure is data stored in cookies? I use cookies to handle user > authentication and session management. But I understand that cookies can > be modified by users and perhaps they can pretend being someone else. > > I store the UserID on my cookies to display the corresponding user > information. What precautions can I take to protect the other users of > my site from this kind of breach? > > Thanks in advance.. > -- > ************************************ > Ivan R. Quintero E.* (507)228-3477 > Aptdo 1263 * (507)228-9105 > Balboa, Ancon * 640-0370 > Republic of Panama * > ************************************ > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net >