I have a PHP application, currently it is highly reliant on Sessions. I am trying to remove most , if not all, session usage from it.
When it comes to logging a user in. I have a few choices,
- continue to use sessions to store basic user data.
- generate my own cookie based token, pointing to an ID of info stored in memcache with basic user data in it, to verify the user
- generate JWT token, stored in cookie, and used for storing an ID pointing to information in memcache to verify user.
Basically , I am trying to avoid issues like session hijacking etc. but I am not sure implementing a JWT system will be as helpful as I first thought.
There is much written it seems about the pros of JWT, but equally, plenty written about "dont use JWT for sessions"
Given that I am not planning on storing actual user data in the JWT token, just an ID, is there much advantage to this over a standard PHP session ID?
Main advantage I see is that I can ensure its not tampered with, but would still suffer from been able to hijacked given that it is stored in a cookie?
Ensuring the cookie is HTTP_Only would help no doubt in some aspects.
So from a security point of view, what is the more trusted, less prone to security issues , method of storing what is basically a session ID stored in another format.