2

I searched "how to check if user is logged in" and most of the answers that I found (on Stack Overflow) are to use PHP sessions. My questions are:

  1. Should I solely rely on PHP sessions to check if the user is logged in?
  2. Should I solely use database every time I check if the user is logged in? (This is what I am using right now.)
  3. Should I use them both?

Are there any vulnerabilities/attacks that I need to be aware of?

1
2

A session is something you use to not have the user enter the password on every request. You store all the data you need about the user (e.g. is she logged in, with what username, etc.) on the server in some kind of lookup table. Then you pass the ID you need to look the information up to the user, so she can use it for authentication without password in the future.

There are many ways to implement this. All implementations need a lookup table (to store the data in), a random session ID generator, and a cookie or some other way to pass the ID between the user and the client.

PHP comes with an out of the box implementation. If you use the PHP session functions PHP will take care of generating the ID, setting and reading the cookies, and looking up the session data (which PHP saves in files on disk) for you. You do not need to worry about these things.

You could off course write your own implementation, using a database as a lookup table. However, there are a lot of tricky things about the implementation and unless you know what you are doing it is easy to make subtle mistakes that will make your system insecure. Therefore I would recommend you to just go with the solution PHP has already provided for you.

Finally, there is no need to use both PHP sessions and a database just to verify that the user is logged in. One is enough, and adding another does not give you any security gain. (You could off course use the database to look up information about the logged in user, such as username and email, but that is another matter.)

4
  • Thanks for this, this is very informative, I will just share to you how I check if the user is logged in, first i make the user's id in the session, then every request I get the user's id in the session and search the id in the database, and if it is found, result is $loggedIn = true;. What can you say about this kind of implementation ? Should I go with session only like what you recommended? Thanks. – Dumb Question Dec 14 '16 at 12:01
  • @DumbQuestion No, that sounds fine from a security standpoint. There are other issues, such as performance, but they are not on topic here and probably not relevant for you. – Anders Dec 14 '16 at 12:09
  • Really? It's good to know! Yes, I am willing to sacrifice a little bit of the performance for the security of the users. Lastly, can I ask what issues will I experienced with this aside from performance? Thanks. – Dumb Question Dec 14 '16 at 12:17
  • @DumbQuestion Just to be clear, I do not know how any of this affects performance. I am just saying it is an issue to think about when choosing a system to handle your session. I do not know what other issues you are thinking about. – Anders Dec 14 '16 at 12:40
3

What would be your plan otherwise? Sessions are merely a way to denote that a user has recently authenticated successfully, so you don't have to keep asking them for their password on every request.

You ask if you should also check the database. If you aren't checking the database, how are you verifying the provided session token is valid?

The most common attack against sessions is session stealing. The most common preventive measures are https on every connection that includes a session, and automatically expiring sessions (ideally not often enough that users complain) so a stolen session is only useful for a limited time.

2
  • I am using the number 2, I am not using https as of now so session is a no no for me ? – Dumb Question Dec 14 '16 at 6:02
  • Firstly, using only a database you can only know when was the last activity of a user on your website, as many users do not log out. You can guess that users are logged when their last activity was seen less than X minutes ago, but you will guess wrong often. Secondly, without using https you cannot be 100% sure that someone pretending to be an user is indeed this user or an usurper. In the end, it's up to you to decide if your configuration is good enough for you. – A. Hersean Dec 14 '16 at 8:07
-1
  1. only session id, case 1

If you solely rely on session to check if the user is logged in or not, then you should consider checking the session id at every step during and after login since, since there is a possibility of session hijacking it can be possible for an attacker to change the session id of current user with someone else.

  1. only database, case 2

You should not consider this option as it will slow down the performance of the portal if you check every time if the correct user is logged in or not.

  1. both session and database, case 3

Always go with this option, since you don't have to go through database every time and make sure to verify if the correct session_id is logged in or not, plus always try to encrypt this session id as well since there is also a possibility for attacker to perform replay attack if you will not verify if the task is being repeated or not.

4
  • in 3, you mean I need to check if the sessionid is valid or not? every time a user make a request ? – Dumb Question Dec 14 '16 at 6:09
  • 1
    yes, everytime the user makes a request you should verify if the correct user is making the request or not. – kandpal Dec 14 '16 at 6:28
  • What do you mean with encrypting the session ID to prevent replay attacks? I have never heard about that, and I don't understand what you are trying to protect against. – Anders Dec 14 '16 at 9:05
  • I have code that will save the user's id in the session, then it will check in the database, if the user's id is found, result is user is logged in – Dumb Question Dec 14 '16 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.