Re: [PHP] Session Authentication

On 4/9/07, Martin Marques <martin@xxxxxxxxxxxxxxx> wrote:
Tijnema ! escribió:
> On 4/9/07, Martin Marques <martin@xxxxxxxxxxxxxxx> wrote:
>>
>> Yes:
>>
>> Don't use transparent session id, or even better, save the
>> authentication in a cookie on the client (seperated from the session
>> array).
>
> And then the user would crack the cookie ....
> I know they are encrypted, but trust me, cookies can be edited.

So what? The user authenticated himself, so what is he gonna crack?
Yes, but i guess you're not only storing if the user has
authenticated, also storing a username?

And if that's not the case, then you could authenticate by creating a
cookie where it says authenticated = yes, and you're authenticated...

Tijnema
.

Relevant Pages

  • RE: Forms authentication cookie handling question (C#)
    ... I also replaced all of my ticket authentication code with the ... // Username and or password not found in our database... ... LoginControl's default code logic to generate authentication cookie. ...
    (microsoft.public.dotnet.framework.aspnet)
  • RE: Forms Authentication
    ... The DNS entry for my domain was not set corrretly, ... This should have overcome the cookie ... authentication ticketis not correctly set to the domain your ... Microsoft MSDN Online Support Lead ...
    (microsoft.public.dotnet.framework.aspnet)
  • RE: Forms authentication cookie handling question (C#)
    ... programmatically generate forms authentication ticket and set it in ASP.NET ... You use the Login control's "Authentication" event to do the user ... LoginControl's default code logic to generate authentication cookie. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: authentication cookie vs session cookie
    ... level of using authentication cookies on the client machines. ... authentication cookie on a manager's machine is stolen and used on a client ... > session variables as it relies on the session cookie that ASP.NET sends to ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: forms authentication cookie problem
    ... authentication cookie. ... what's going on on the server. ... >324488 Forms Authentication and View State Fail ... >characters, the browser will still request the page, but ...
    (microsoft.public.dotnet.framework.aspnet.security)