Timeline for Is it secure to use SQL for storing authentication codes?
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 17, 2017 at 10:46 | history | edited | CommunityBot |
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
|
|
| Oct 24, 2016 at 18:07 | comment | added | Out of Band | You said you don't need to carry around much state for the user. If you just store that state directly in the cookie (basically just a user name, login timestamp, and nonce) and encrypt it, you can follow cymcbeans advice and use short-lived session cookies, and session cleanup will be done automatically by the browser when it is closed. | |
| Oct 24, 2016 at 17:21 | comment | added | Twijn | The cookie is set to expire in 1 month. There is a reason to this, even though it's not a very good reason. At this point the session does not get deleted from the database automatically. Instead it will be deleted when there is a failed login due to expiry of the code. Having at 1 month means it will more likely get deleted however I'm still working on it and plan to delete automatically. Also, how do you enable https? Is it an option? It is also hashed using password_hash in PHP | |
| Oct 23, 2016 at 22:36 | history | answered | symcbean | CC BY-SA 3.0 |