User Authentication Method?

[alsaffar]

Hi there,

Which one is better to use for user's authentication, cookies or sessions?

I just started coding a nice script for handling User's signUp and login using cookies, and I found that if the user forgot to logout and the cookie is not expired yet, any one can log to any page using the first guy userName and password in the same PC, cause I put at every page a small code to grab the userName and password from the cookie I set.

So, any idea how I can delete the cookie automaticaly when the user close the session and forgot to logout?

 

[danielhozac]

Don't set the expires argument to setcookie. That will delete it when the browser is closed.
And in my opinion, sessions are better for user authentication. Cookies can be very easily manipulated as they are stored on the users computer. If you use sessions, the information is stored on the server. //Daniel

 

[alsaffar]

Well, I tried not to set the cookie to an expire time, I just left it blank "", then I login as any user, and the browser asked me for setting myDomain cookies, after accepting those cookies, I logged in, and I can check that the cookie was set and I can get any information I need from this cookie like userID and UserName and Password via a script I made,

then, before I closed my session, I checked my cookies folder in my PC and I couldn't find my cookie there!!! so the cookie isn't stored at all in my PC even in the session life,

CONCLUSION:
----------
SO, if I didn't set the expiry date, and the session is not closed yet, the cookie will not be stored at all on the user PC, and so, no one can edit that cookie to gain through my database,

so, I think using cookies with no expiry date is secure enough.

QUESTION:
--------
Any comments on my conclusion?

 

[SkyHigh]

Hi alsaffar

I am looking to add the same functionality into one the applications we have here, and I am not a php developer, can you be kind enough to share the code you wrote with me ?

If yes, please send it to miss_logic@hotmail.com

Thanks for your help
Brenda