Question

I want to know in my application which is mainly php, which is best method in order to keep a user logged into a site until they have logged off. Could it be tokens, sessionlife, cookies etc?

At the moment this is how my login and logoff system works:

When a user logs in, it stores in their details in a $_SESSION:

if (isset($_SESSION['teacherid'])) {

      $userid = $_SESSION['teacherid'];

  }

if (isset($_SESSION['teacherusername'])) {

      $username = $_SESSION['teacherusername'];

  }

Then in every script it contains the code below where the sessionlife lasts for 12 hours:

<?php

ini_set('session.gc_maxlifetime',12*60*60);
ini_set('session.gc_divisor', '1');
ini_set('session.gc_probability', '1');
ini_set('session.cookie_lifetime', '0');
require_once 'init.php'; 

session_start();

?>

init.php is this below:

 <?php
 session_save_path('Session'); 
 ?>

Now after 12 hours the next time the user refreshes the page, as the session will be destroyed, it goes to the logoff page:

    if ((isset($username)) && (isset($userid))){
        session_destroy();
        echo "You have been Logged Out | <a href='./home.php'>Home</a>";
    }

    else {

        echo "You are Not Logged In";

    }

Obviously if the user clicks on the logout page then it navigates to script above.

But is this a good way of doing it? Is there a much more convenient way because if you look at proper web applications, they can keep users logged in for days, but how do they do this?

Thanks

Answer 1

Sessions will do in a pinch, and they are secure enough (although don’t quote me on that), but depending on server usage and configuration, your sessions may be cleared before the 12-hour mark.

Upon login, I initiate a session and save a cookie to their computer. This cookie contains a uniquely generated string and their account id.

When they refresh the page, the following is run (pseudocode):

if (session_exists) continue();
else if (!session_exists AND cookie_exists AND validate_cookie()) {
    login_user_via_cookie();
    continue();
else show_login_page();