How to safely store cookies containing sensitive data in PHP?

I would like my users to be able to "Keep me logged in" when they log in to my site. At the suggestion of the main answer to this post, "Keep Me Logged In" is the best approach , I decided to hash the combination of user salt and password in one cookie and save the user ID (number) in another cookie. Of course, the hash value will also be stored on the server side of the database to check when the user returns again. The salt value that I used is the same as what I used to hash the user's password when it first logs in, so it is static - it does not change between sessions. There are several problems that I see with this approach.

1) Is using a registration salt a good idea if it is static, or should I generate a different salt each time for a cookie?

2) If someone needs to access cookies and they copy them to another computer, and then try to access the website from this computer, theoretically he will automatically log in with this user account, is there a security problem?

3) In a scenario where a user with malicious intent had to gain access to a database, the protected website would have salty and hashed passwords, due to which the hacker could gain access to several accounts (if at all). But just by playing with the hash and salt values ​​and creating a cookie that matches the values ​​that they changed in the database, they can effectively access any account they want, making the whole process of password hashing useless. Therefore, this cookie method, which I use now, jeopardizes my entire database and all my user accounts.

, : cookie PHP , , ? , -, Gmail Hotmail, "Keep me logged in", , , , ?

+5
1

cookie, hashed . , - cookie. , , 128- ( ) cookie. , .

- cookie , - , ,

. . , IP- ( ) ( ..), . (, , , , wifi.)

cookie " " SSL. , cookie , , , . ( , , cookie - , , .)

, , .

, . , ( ), , " ". , , , . , .

, , " " . -, .. . , , .

, , cookie PHP - , " " ! . " " .

: cookie - , SSL cookie , , ... .

+9

All Articles