(BTW, this is all coded in PHP as I'm sure you'll be able to tell from the function below)
When saving passwords, I am aware that you have to hash your passwords, in fact here's my code (tell me if it's secure enough) :
function hash($password)
{
return password_hash($password, PASSWORD_BCRYPT, array(
'cost' => 12,
'salt' => bin2hex(openssl_random_pseudo_bytes(16))
));
}
However, my actual question is whether I am using an appropriate login system, or not. In the next paragraph I'm going to explain how my current system works and can someone please tell me if it's OK or needs to be changed. I've heard that the proper way you're suppose to do it is with a token that the client then saves in the cookies or something.
When the user first arrives on the site, and their account is registered, they're prompted to login. With the password they provided, I hash it and check if it matches, with password_verify(), the password in the database. Once validated they have the correct login information and I can go ahead and authorise them I set in the $_SESSION the username and password (which I understand is stored on the server side), and if they ticked the remember me button I save the username and password (unhashed) in the cookies to expire in 1 week.
Every time they attempt to do a new action, for example load a page like account information, it runs a function at the top of the code which returns if they're authenticated or not, to check if they're authenticated or not, it checks the $_SESSION for the username and password and authenticates them again. If they've ticked remember me and the $_SESSION has expired it grabs the username and password from there.
My concern is that I'm sure most websites use a token system, so that when you login it saves a token in your cookies and then instead of signing in every time, it uses the token. And also on forums for example you can check who's online whereas with mine, you can not.
Can someone please respond whether what I've done is correct, or it must be changed, or it's not the best but technically it's secure. The session part I'm pretty sure is secure, and even more secure than some videos I've watched, some say that you can just store the user's ID in the session which means if they change their password they're still logged in. But the cookies part, it's tripping me up with cookie stealing scares saving it unhashed in their cookies.