用户登录/记住我/禁令系统

Question

I currently have it that when a user logs in their username and userid are saved in a cookie. As this isn't the most secure method i now plan on changing the method;

When the user logs in, a unique token is saved in the cookie. The username, userid, banned boolean and unique token are stored a session. The token in the cookie has to match the token in the session to be logged in.

I've thought about storing the token in the database? Alot of times in my code i quickly require the username and userid, so storing in a session is the most logical idea to me instead of always querying the database.

Anyway, is my method appropriate?; if not, what is a proven method?

Answer 1

Your method sounds appropriate. It's not clear to me where you plan to store the session object, but I think it's fine to store it in a session table in the database. It's true that this requires a database query to retrieve the session from the database before rendering every page (for example, you probably want to redirect to the login page if the session token is bad), but that is not a performance problem in my experience. As a bonus, once you have a session table, you can run interesting queries on it to track the usage of the Web app.

My copy of Programming PHP says "The best way to maintain state with PHP is to use the built-in session tracking system." You should consider that before writing your own.

Whatever approach you take, you should probably make sure that the session token is generated randomly, and expires after a reasonable time. Otherwise an attacker could forge a session token by guessing it, or steal someone else's session token and hijack their session.