I am doing my own login authentication system, and I want to do a robust system. I want to decide which direction I should take to keep the user logged in. I have put a question for each way, and also what I think the pros/cons are.
- How safe is it to store a "User" object, with many properties (including encrypted pass) in a base64 string?
Disadvantage: Must be encrypted so the user can't easily manipulate data
Advantage: Can be set for longer periods of time, and can persist during sessions.
- How safe is to store sensitive plain text data?
Disadvantage: Only lasts for the server session.
Advantages: Cookie is automatically encrypted, and simpler to code than cookies.
What are other advantages and disadvantages?