There are many instances in my code where quick access to the logged in username and userid is needed. I currently use cookies. This isn’t secure.
I thought sessions would be a solution but sessions expire.
Another option, is to store a unique token in a cookie and then match with a stored token in the database, to retrieve logged in user data. This is the most secure solution but the problem i see with this is, there are many times in my code where the logged in username and userid is needed but querying all the time would use up resources unnecessary(is this true?)
What is the solution?
If it is not needed on the client, make sure it does not end up there.
Since userId’s are specific to a logged in user and not a specific computer, a cookie does not seem like the way to go.
Basic authentication in PHP is usually done with sessions, so you could just as well add the userId to the session.
If the session times are too short, increase the session time.