PHP，cookie和快速浏览器刷新

Question

For my login system, I have a token value that changes every time authentication occurs. Authentication occurs every time any page is accessed (by looking for token cookies and sessions ad such), as well as every $.ajax call (my thought is that I would want to ensure the user is authenticated at all times, and if ever authentication fails with a bad token or series or whatever, the system would automatically completely log out). During the authentication process, when it is determined that the current session is valid, a new token is generated, and that token is set as a cookie as well as updated in a MySQL table, as such:

$newtoken = hash("sha256", mt_rand());
my_mysqli_query($link, 
                'UPDATE _rememberme SET token = "'.$newtoken.'", lastupdated = "'.now().'" 
                 WHERE series = "'.$series.'" AND email = "'.$email.'"');
setmycookie("token", $newtoken, 7);

When I rapidly refresh the browser, it ends up that the MySQL token and the cookie token do not match. I think that the problem is that during a rapid refresh, the MySQL table gets updated, but then a refresh occurs and the script aborts before updating the cookie. This causes future authentication failures because the cookie token doesn't match the MySQL token.

I would really appreciate some ideas on how to survive a user rapidly refreshing their browser.

I have researched this issue and had little success in finding a solution.

Answer 1

Your solution adds nothing to the security, and adds a great source of headache to your users.

If you use PHP Sessions , you don't have to rely on multiple cookies, and don't have to hash everything on every access. Having sessions in place will increase the security, as your users will not be able to change their session variables. A cookie is user-modifiable, so you can't blindly trust them. A user can change the PHPSESSION cookie, though, but the chances of changing the session to another one is so, so small that is almost impossible.

With your current code, if a user opens a link on a new tab, and before the request returns he opens another link, he will be logged off. The cookie will change on the first request, but before the browser gets the new value, the user submits another request with the old cookie. The new value is on the database, the new request with the old value is processed, and the session is invalidated. Another unhappy user confused because he was randomly logged off.