So, basically I am trying to log a user in with a cookie and do not query DB to improve performance.
Here is a brief idea:
- Transmit everything via SSL
- Set a Global secret key A and secret key B
- Generate a random verification string on registration and password change
- Encrypt the verification string with A, store it in cookie
- Encrypt the verification string with B, store it in cookie
- When user tries to login, I decrypt each string with A and B, compare if they match
I am wondering if it is a good idea if it is:
How can I actually do the encryption in Java, using bouncycastle ASE-256, Digest or whatever?
How much does this encryption/decryption process affect the performance, when compared with authentication by storing a session variable in a super fast DB like Redis?
If it is not: What should I do?