Question

What is the best way to securely authenticate a user ?

So far I was thinking of:

• Generate a random $SALT for each successful login and store $logged = md5($hashed_password.$SALT) into database; delete on logout.
• Store $logged into a cookie (If user checked “remember me”). Set $_SESSION['user'] = $logged;
• On a visit: Check if $_SESSION['user'] is set; if not, check for cookie, if data doesn’t match, redirect to login page.

What are the risks ?

Answer 1

The only issue I can see with your existing framework (which I like otherwise) is that there is the possibility of collision for $logged.

It is not mathematically impossible for two valid user log-ins to result in the same hash. So I would just make sure to start storing the User id or some other unique information in the Cookie as well.

You may also want to keep a timestamp of when the $logged was put in the DB, so that you can run cleaning queries where they are older than x days/weeks.