RE: [PHP] Secure user authentication
| From: | Jon Haworth | Date: | Fri, 03 May 2002 14:43:43 +0000 |
| Subject: | RE: [PHP] Secure user authentication | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-95905@lists.php.net to get a copy of this message | ||
Hi,
> The method I was thinking about before was to pass
> the md5 hash of the password around, as the passwords
> are already md5'ed in the DB. Your method seems more
> secure as you use a totally spiced-up and personalized
> encryption engine.
*boggle*
Why are you passing the password around, hashed or not, in the first place?
Just have a yes/no flag for whether the session is an authenticated user or
not.
Is there any particular reason why you'd need to reauthenticate on every
page?
Cheers
Jon