Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm a PHP web developer who has been reading up on security recently and consequently this question entered my mind: How to properly and securely authenticate already-logged in users with a token? I've seen the technique mentioned several places, but I haven't found a demonstration of it.

I implemented a version of it myself that works like this:

  1. The user logs in using his username and password. (Stored using a 1024-bit pbkdf2 hash)
  2. A random token is generated then MD5'ed using the following PHP code: uniqid(mt_rand(), true)
  3. This information is stored in the database, a PHP session, and a cookie.
  4. When the user accesses a page, a function is called that checks whether the token in the session or cookie matches the token stored in the DB. If it does, the user stays logged in, if not, the user is logged out.
  5. Every time a request is sent to the server, this function is called and steps 2-3 are repeated.
share|improve this question

1 Answer 1

up vote 2 down vote accepted

A good thing to do when proposing a security concept, is to create a list of scenarios, that it needs to protect against. Without that framework, it is hard to comment.

Let's compare it with session handling:

  1. The user logs in (or accesses the site)
  2. A random token called sessionid is generated
  3. The sessionid (and other information linked to it) is stored on the server (in a database, filesystem or memory)
  4. When the user accesses a page, a function is called which checks the session id and reads associated information. If the sessionid is valid, the user stays logged in. If not, the user is logged out.

So the main difference is step 5, in which you generate a new token for the next request.

So if one request is missed, the user will be logged out. This might help a user to detect that he was a victim of a CSRF attack. But being logged out will most likely not raise much suspicious to normal users.

You force a strict order of requests. If two requests are processed in parallel (e. g. opening two browser tabs within a short time frame), both will send the same cookie. As a result, one tab will fail and the user will be logged out.

share|improve this answer
    
Thanks for taking the time to answer. I hadn't thought of the fact that a user can be logged out due to delayed or simultaneous requests. It would of course be inconvenient to the user, but under normal operation it should be fine. I've browsed the page with many windows and tabs and I've never run into that problem. With that said, what I was really wanting to know was if there was a standard way to do this. I'm assuming CSRF requests are common and something almost everyone should defend against. I'd +1 you, but I'm new here :) –  Cbeppe May 22 '12 at 21:58
    
Also, you mention that being logged out will not raise much suspicion from users. As a developer, I would say this is a good thing, because it could confuse or "scare off" certain users. Do you have another take on that? –  Cbeppe May 22 '12 at 22:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.