Question

I need to build my own system for part of a computer security project without using php sessions (just cookies) and im just lost. All the tutorials ive found use sessions (for good reason) so I was wondering if anyone knew of a roll your own php user authentication tutorial.

Answer 1

You could basically implement something session like yourself.

This would include the following tasks:

• generate a random session id for new users (or on login – based on the exact use…)
• save it into a cookie
• do save additional session inforamtion somewhere on the server together with the session id (e.g. in a database table)
• on subsequent page accesses check the session id in the cookie versus the data on the webserver to identify users and grant access

However it should be mentioned that a cookie only based solution is never that good. If a client for example doesn’t have cookies enabled it won’t work at all. A possible solution for this is to send the session id as GET parameter with every internal link if cookies are not enabled.