Using Tokens to Keep Users Logged In

Question

I'm a PHP web developer who has been reading up on security recently and consequently this question entered my mind: How to properly and securely authenticate already-logged in users with a token? I've seen the technique mentioned several places, but I haven't found a demonstration of it.

I implemented a version of it myself that works like this:

1. The user logs in using his username and password. (Stored using a 1024-bit pbkdf2 hash)
2. A random token is generated then MD5'ed using the following PHP code: uniqid(mt_rand(), true)
3. This information is stored in the database, a PHP session, and a cookie.
4. When the user accesses a page, a function is called that checks whether the token in the session or cookie matches the token stored in the DB. If it does, the user stays logged in, if not, the user is logged out.
5. Every time a request is sent to the server, this function is called and steps 2-3 are repeated.

Answer 1

A good thing to do when proposing a security concept, is to create a list of scenarios, that it needs to protect against. Without that framework, it is hard to comment.

Let's compare it with session handling:

1. The user logs in (or accesses the site)
2. A random token called sessionid is generated
3. The sessionid (and other information linked to it) is stored on the server (in a database, filesystem or memory)
4. When the user accesses a page, a function is called which checks the session id and reads associated information. If the sessionid is valid, the user stays logged in. If not, the user is logged out.

So the main difference is step 5, in which you generate a new token for the next request.

So if one request is missed, the user will be logged out. This might help a user to detect that he was a victim of a CSRF attack. But being logged out will most likely not raise much suspicious to normal users.

You force a strict order of requests. If two requests are processed in parallel (e. g. opening two browser tabs within a short time frame), both will send the same cookie. As a result, one tab will fail and the user will be logged out.