Securing PHP Sessions

Question

I have been reading up on the best way to keep a user logged to my website, so that they don't need to login to perform every action or view every page.

I have realized Sessions are the way to go over Cookies as their data is stored on the server end not on the client end.

I had a plan where I was going assign the session to a single IP Address and user agent and authenticate it is the same IP and Useragent each time. However apparently that's not the way to go.

So really my question is what is the best way to make some truly bulletproof, secure sessions.

Answer 1

You need to use a combo of both COOKIES and PHP sessions.

Use a cookie to store some form of the session id, and just load that session id when you see the cookie.

A PHP session is a browser cookie in and of itself, it just usually expires when the user closes their browser window.