Question

How to securely store usernames in database, without adding them directly to cookie value?

Example:
I want to display username of logged user.
If he have closed his browser early the only way to do this is $_COOKIE[‘cookie name’]
where cookie value links with username in database.
So I don’ t need to hash username.

Is it right? And if it’s right, is it secure?

Answer 1

The below is assuming you are talking about a persistent login feature using cookies. For the purpose of just remembering the user name (but not signing them in automatically), having a username in the cookie (optionally encoded) should be okay though. Regardless, passwords should never be in the cookie.

---

Cookies should NOT be directly identifying, i.e. user ids / names should not appear in the cookie. Instead, you should assign a sufficiently long enough string with random data to the users in your table and store that in the cookie value. Once used you should update the string and issue another cookie.

For example:

john | ewojroj1234ojqewor
jack | ljqwelkn1k31n23k33

The second column will be placed in the cookie. Later you will query that value against the user table and:

1. fetch the user data and store inside a session
2. regenerate the random string
3. issue another cookie

Password changes and signing out should also cause a change in the user token string.

For further reading, Barry Jaspan wrote a good article on this approach.