Welcome Guest, Not a member yet? Register   Sign In
Best aproach to store Remember Me data
#2

(This post was last modified: 12-18-2017, 12:05 PM by jreklund.)

I'm using Paragon Initiative approach for this: Implementing Secure User Authentication in PHP Applications with Long-Term Persistence (Login with "Remember Me" Cookies)
Only a selector and token are saved, not a userid. That's only available in the database.

The automatic login algorithm looks something like:
1. Separate selector from validator.
2. Grab the row in auth_tokens for the given selector. If none is found, abort.
3. Hash the validator provided by the user's cookie with SHA-256.
4. Compare the SHA-256 hash we generated with the hash stored in the database, using hash_equals().
5. If step 4 passes, associate the current session with the appropriate user ID.

Q1. Re-use the selector and only update the token. Or both if you want. You will get the ID if step 4 match.
Q2. Not possible, if you are using the right functions.
Reply


Messages In This Thread
RE: Best aproach to store Remember Me data - by jreklund - 12-18-2017, 11:51 AM



Theme © iAndrew 2016 - Forum software by © MyBB