如何设置安全cookie以指示用户已登录？

Question

Currently, after a user logs in, I simply store the user's ID number in a cookie using the following PHP code:

setcookie('userid', "$userid", time()+60*60*24*7*2, '/');

The above code sets a cookie that lasts for 2 weeks and contains the user's ID number (stored in the variable $userid) that is not private. It also allows the user to stay logged in for 2 weeks. I am aware that this is probably one of the least secure ways to set a cookie to indicate that a user is logged in, since one can simply change his or her cookie parameter and log in as any user he or she wishes.

Therefore, how do a I set a cookie that accomplishes everything my cookie above accomplishes but is also secure?

In other words, what is the best way for me set a cookie that is secure and allows me at the very least to identify the user's ID number during his or her session? I would also like the cookie to last 2 weeks, so the user doesn't have to keep logging back into my website.

Answer 1

Use sessions instead. It'll store a session ID in a cookie but all the actual data is stored on the server so nobody can mess with it.

Answer 2

You should also send a second cookie, a hash value, that is unique to the user. For example, in the second cookie store the hash of the user id, user name, password, and salt value.

md5($userId.$userName.$passwordHash.$userSalt);

Since you know the user ID from the first cookie, find that user in the database. The second cookie should be used to validate the user ID. If the hash cookie value doesn't match exactly, you know your server didn't provide the second cookie and you should reject the implicit login request.

Answer 3

Use a secure hash (known to the server only) in combination with some data specific to the user and create a hash. Save that as the value instead of the id. When you get a request, compare the hash by regenerating it. Note that it's still vulnerable to XSS attach or CSRF. So address those as well if you are concerned. Cookies are bad way of storing data, what above will stop is someone just setting a cookie to a random user id and login.

This is if you want an auto login and keep it separate from session id. If not do as the other answers suggest and use session.

Answer 4

All the user data must be stored in session ,after a successful login . when you call session_start() a unique id will be generated and that will be stored in browser cookie .and every time browser make a request it will send the value in cookie along with it.for stronger security you can regenerate the session id after successful login.

Answer 5

You could also use mcrypt, to encrypt some data in a cookie, it is my prefered way of storing something in a cookie.

If you ever need it for some purpose, then just decrypt it.