1

I am making a php website that requires user login. It has a remember me function. I would like to ask if the following approach is safe ?

  1. User logs in with correct username and pass (and remember me option).
  2. I will get his userID , hash it , and save that string in a cookie against some key , like 'usercookie'

I would like to know if this is safe. If not , what is the best way to do this ?

  • I think there's a little more to consider than what you've mentioned. MD5 and SHA1 are not very secure. What encryption are you using for the hash and is it salted? Will the username and password be sent over SSL or not (https vs http)? Does the cookie ever expire? Is this for educational purposes or for a production app? If the latter, why not consider a framework? – trpt4him Jun 17 '15 at 12:45
  • the user/pass is sent over ssl, yes. But the question is not that. My main question is how to save the cookie safely. – harveyslash Jun 17 '15 at 12:55
  • Is using a system such as OAuth or OpenID an option? If yes, do it. Unless you have a solid experience in security, there are few chances the system you'll create from scratch will be secure. – Arseni Mourzenko Jun 17 '15 at 13:00
  • You don't want to save the user id hash on the client. Save it as part of a session variable as I described in the other question. You only need to store a unique and random session id on the client. From that you can retrieve the session information from your database. – GrandmasterB Jun 17 '15 at 17:05
2

That is relatively safe, providing that you use SSL (HTTPS, use ssllabs to check the security of your site), and you configure your cookie to be domain-specific, have an expiry date not too far in future and be "HTTP-only".

Use mcrypt for encryption (there's support for that in PHP) and the salt key should be reasonably long, and kept SECRET, or change for each cookie (this is a little more complicated).

Also, consider what is the sensitivity of the information you hold for the user, and assess what would be the worst consequences if someone has stolen your user's data.

By definition, a system is secure if the cost of hacking it is greater than the intrinsic value of the data that can be stolen. Use this rule as a discriminator for your security assessment, to determine if you should worry about some more advanced techniques, of if the ones listed above would be enough.

It is also worth mentioning that - if the mentioned above was not enough, you should probably NOT offer your users the "remember me" option: banks do not do that, for obvious reasons.

| improve this answer | |
1

To start off with your login, I'd like to say that the password should be stored safely as well(This is probably not your main concern).

Whenever you use sessions or cookies, you're vulnerable to session hijacking. Now on that link, there are ways to prevent session hijacking as well.

Like:

Encryption of the data traffic passed between the parties by using SSL/TLS; in particular the session key (though ideally all traffic for the entire session). This technique is widely relied-upon by web-based banks and other e-commerce services, because it completely prevents sniffing-style attacks. However, it could still be possible to perform some other kind of session hijack.

Use of a long random number or string as the session key. This reduces the risk that an attacker could simply guess a valid session key through trial and error or brute force attacks

So it's not 100% secure. There are more ways to prevent it.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.