Question

I have a method where i check the username and password(hash+salt) is correct. After that, and if the user have acess i do:

 if(isset($remember) && $remember == '1') {
        setcookie('email', $email,  time()+60*60*24*100);
    }
    else {
        setcookie('email', $email, time()+3600);
    }

My question is about security issues. the code above is insecure ? It is needed something like a signature ?

for example:

$user_email = $email;
$hash = sha1(rand(0,500).microtime());
$signature = sha1($hash . $user_email); 
$cookie = base64_encode($signature . "-" . $hash . "-" . $user_email);
setcookie('authentication', $cookie); 

What do you think ?

Answer 1

Anecdote time: Back around 2002 I was looking at a packet dump from my school’s network and told them that they needed to fix their grades, attendance, student information, everything-under-the-sun system. The way they had it set up was such that after a user authenticated, the system would set a cookie with just the user name and an end-of-session expiry. I fired up a browser, picked a username (first initial, last name), and set that as a cookie. I had access.

What they should have done was set a random 128 number and kept track of that in the server (number, corresponding user, timeout value).

See also

• Good session practices.

• How to securely hash passwords.