Login

03-05-2011, 04:03 AM

[eluser]Unknown[/eluser]

Code:
$config['sess_cookie_name']        = 'mywebsite';

$config['sess_expiration']        = 7200;

$config['sess_expire_on_close']    = FALSE;

$config['sess_encrypt_cookie']    = TRUE;

$config['sess_use_database']    = TRUE;

$config['sess_table_name']        = 'ci_sessions';

$config['sess_match_ip']        = TRUE;

$config['sess_match_useragent']    = TRUE;

$config['sess_time_to_update']    = 300;

This is my config and I have creat a session database, all work OK!

I can me there is the cookie: mywebsite=QWSwahsdagdhga......arqgyejhqHN (which is encrypted)

My question is what in this cookie!? Is this session_id or anything else!?

-----Another question---------
I'm using CI session in my login system, ad my question is what shuold I store and check after user logging success to make my system more secure!?

Thanks for your help!

03-05-2011, 04:33 AM

[eluser]WanWizard[/eluser]
The encrypted cookie only stores the session id, the IP address, the user agent string, and a timestamp.
It does not store any user data, since you're using the database for that.

The simplest thing is to store the user_id in the session. At the beginning of the page request, check if the id is present, and if so, retrieve the user. If that succeeds, the user is logged in.