Comments on: Authentication without sessions in PHP

By: Arnold Daniels

Arnold Daniels — Wed, 22 Jul 2009 16:14:36 +0000

ccapela,

The code does 2 things:
1.) Check if $authhash is valid, by doing the same operation as done when creating the hash on line 20.
2.) Check the timestamp to see if the hash was created less than 50 minutes ago. This means that there is a 50 minute time out.

By: ccapela

ccapela — Tue, 21 Jul 2009 16:44:34 +0000

Hi Arnold Daniels

Can you explain me please, this instruction in your code above?

$logged_in = md5($username . $time . $secretword) === $authhash && $time >= time() – 3000;

Thanks in advance,
ccapela

By: PHP Encoder

PHP Encoder — Wed, 02 Apr 2008 17:22:21 +0000

I often use this method as sometimes you just can’t use sessions or cookies and the above method is the only elegant solution.

By: ThanosEA

ThanosEA — Fri, 14 Mar 2008 17:01:20 +0000

I try to use the new version of teleport for my website but when I test, firebug give this error ‘jpf is not define’.

When I compare with my old version I can’t find the initialisation of jpf as Kernel (Kernel =)

Anyone could help me ?

By: Arnold Daniels

Arnold Daniels — Thu, 13 Mar 2008 13:10:48 +0000

You can save if it in a cookie if you prefer. However I don’t think it’s false security. If you don’t have the hash, you can’t get it in. If a user copies and pastes the hash, it’s a different story.

The exact same goes however for session ids. If you don’t like putting session ids in URLs, don’t put the hash in an URL but put it in a cookie instead.

By: David Branco

David Branco — Thu, 13 Mar 2008 12:26:18 +0000

For security reasons I wouldn’t support authentication via a GET or POST methoud. These can easly be shared and often lead to a feeling of false-security. As stated above, limiting the session by IP will help dramaticly; however, I am also aware that many companys run a single building consisting of several hundred computers throught the same Internet Protocall Address.

By: Arnold Daniels

Arnold Daniels — Thu, 06 Mar 2008 14:41:03 +0000

In most cases, storing it in a file will be faster.

By: kate

kate — Thu, 06 Mar 2008 13:39:15 +0000

Thanks for your information.I have another doubt?
Storing session in db is fast?
http://www.w3answers.com

By: Arnold Daniels

Arnold Daniels — Thu, 06 Mar 2008 13:25:38 +0000

Yes, you can save session data in the DB. Have a look at this article: http://www.devshed.com/c/a/PHP/Storing-PHP-Sessions-in-a-Database/.

You can use it if your site is so popular that it needs multiple webservers with load balancing. The session data should be known on each of the servers.

I don’t see any security advantages. If someone has access to read the session file, he can probably also the configuration file of your webapp with the mysql password. If you have users other than you on the system and worry they might fish a session file out of /tmp, you can create a /session dir and make it only readable for www-data.

By: kate

kate — Thu, 06 Mar 2008 12:09:30 +0000

Do you mean that we can store sessions in database? waht is the advantage of this ,instead of storing in files.db also will take time to load.But i think for the security issues db is good.but not sure.please clear my doubts.
http://www.w3answers.com