Question

I am experimenting with sessions.

I am trying to get it to be a secure session, I have the user only receiving a session variable of “signin”equal to 5 only after they have been verified through salting and hashing.

 if($passwordhash == $tablehash)
    {
            session_start();
            $_SESSION['signin'] = 5;
            header("Location: /~cssgf3/cs3380/lab7/home.php");

And then I have the page that it gets redirected to being verified through this step:

session_start();

$sessionValue = 5;//$_SESSION['sessionValue'];
$userSession = $_SESSION['signin'];

if($userSession == $sessionValue)
{

I am curious if this is an appropriate way of authenticating a session. I’m not too worried about security at this point, but I am interested if this is at all secure and if not if theres a somewhat easy way to fix it?

Answer 1

Broadly, yes, but without understanding more of your code it’s hard to say.

You’d be better off assigning a unique value to the user – rather than an INT value of 5.