如何检测用户何时登录？

Question

I'm currently working on a little instant messaging project. So far everything has been going pretty well.

The only problem is security. When someone logs in, 2 cookies are set.

1) Name: loggedin; Value: {username}  
2) Name: mvc; Value: {userSecretKey}  <-- pretty useless

These are the cookies that I use so I can setup the next page. However, I believe there is a far better way to do this. And no, I don't want to use sessions because I have a "remember me" feature.

Someone could just set the cookies themselves and "sign in" without actually signing in.

What would be a better way to set this up? Maybe some sort of changing key?

Answer 1

I would suggest using PHP Sessions alongside cookies that are purely used for the remember me feature. You could set it up like this:

1. User logs in
2. You store the user IP and Useragent in the session
3. If remember me is enabled, create a new database entry with the user id, an unique random id + IP & useragent of user, then add a cookie that references the unique random ID.
4. Everytime you access the session, check that the request IP and Useragent match with the ones originally set in the session when the person logged in.
5. When the user returns after they close their browser, where only the remember me cookie is left, compare the request IP and Useragent to the one in the Database
6. If they match, log them back in automatically.
7. Users have fun.

Cheers!