在PHP中维护用户登录的建议？

Question

That is, once the login credentials are checked and verified, what happens next so that on subsequent page loads (and page visits from other already logged-in sessions) the visitor is securely confirmed to be valid and logged in?

Should one use a mix of $_COOKIE and $_SESSION? What specifically is stored in either so as to be secure?

Do you confirm both or just one (if so, which) against the DB on each page load?

The best guides I can find are at 8 and 10 years old:

http://fishbowl.pastiche.org/2004/01/19/persistent_login_cookie_best_practice

http://jaspan.com/improved_persistent_login_cookie_best_practice

surely there is something more current that I am just unable to find?

Any guidance would be supremely appreciated.

Thanks kindly

Answer 1

The most common way to keep track of whether or not a user is logged in is to use a session variable, and check that the session variable is set at the beginning of each script that only should be accessed by users that have previously logged in.

Having said that, there are a number of potential vulnerabilities that you should be aware of (such as session hijacking attacks and cross-site scripting attacks), and you should code accordingly to make sure that you site is not vulnerably to these types of attacks. For instance, the cookies used to keep track of the session should be sent over https only, and should not be accessible to client-side scripts. Regenerating the session every time the users privileges are elevated, to prevent session fixation, is also a good measure.

The article below also has some good information: http://www.wikihow.com/Create-a-Secure-Login-Script-in-PHP-and-MySQL