Question

currently i have code, to authenticate user and save the authentication username and password in db session, which gets validate on every request.

i was thinking to change the validation method to authenticate user only once and keep success authentication in db session, But dont validate user again, if he is session user and already validated.

would this new approach is safer? or should i just validate user on each request, even if its saved on session?

Answer 1

You should do this:

• keep a table of username and encrypted passwords in your database (encrypted = at least salted & hashed)
• have your users send you the username and password, possibly hashed client-side, and ckeck it againt the hash
• check the credentials once and set something in your session which will flag the user as authenticated

You should never keep password clear text, and you should not store extra authentication data in your session tables. Even if you check them at each request, you are in fact just checking if your remote user (i.e. his cookie) provided the correct username and password the first time on your session… you can have the same exact result if you just set a variable in your session…