Re: Handling sessions through cookies, is it safe?

romayankin@xxxxxxxxx wrote:
I need to limit the session time for a particular user who is working
on my site. I'd also like to extend the session time each time user
performs some action (moves from one page to another). I've written the
following code to accomplish this task

/* Extending session */
if(isset($_COOKIE['username'])) {
setcookie ("username", $_POST['username'], time()+3600);
}

Variable $_COOKIE['username'] right after the authorization is
completed.
The problem is that I don't think this is a safe way to handle
sessions. Perhaps I should use $_SESSION global array to store the
username of the logged user?


In my opinion, all you should store in a cookie is session-id. Everything else, you store on server in either global session veriable or in a database.
.

Relevant Pages

  • Re: Concurrent session issues. Currently our website can have only one window open. Help me solve th
    ... Searching and showing search result to user. ... unique session with search condition and use session every time user ... Tony Marston je napisal: ...
    (comp.lang.php)
  • Re: Handling sessions through cookies, is it safe?
    ... I'd also like to extend the session time each time user ... Perhaps I should use $_SESSION global array to store the ... you store on server in either global session veriable or in a database. ...
    (comp.lang.php)
  • Re: Handling sessions through cookies, is it safe?
    ... I'd also like to extend the session time each time user ... you let them post their username on every navigation? ... Perhaps I should use $_SESSION global array to store the ...
    (comp.lang.php)
  • Re: Storing a datatable (or arraylist )on ASP.NET Session
    ... Perhaps your ArrayList store smth which can't be casted to object. ... If exactly that code u shown didn't work (emply arraylists) that I recomment to re-register asp.net 2.0 calling aspnet_regiis,exe - i ... Team blog: http://devkids.blogspot.com/ ... b> session variables is stored on web server's local sql database. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: LISP for web
    ... >>Ideas on how to store this information centrally for all of the app ... > ucw's form handling code (to make sure session ids are always ... > can deal with hardware failures an the app servers but this ...
    (comp.lang.lisp)