There's a website I visit and I can't understand fully the login process and session hash it creates and uses to keep track of logins and such.
Would someone help me understand what goes on in server and what happens to session IDs and login info? (saved in a cookie file)
I enter my username and pass, a cookie is saved to my PC named PHPSESSID. It contains a 32 character hash (MD5?) It says it expires when session ends. If I logout and login again (even using the same username) this hash changes. Needless to mention, logging in with other usernames also makes this hash change.
- If this hash is made from my username and pass, why it changes?
- Is the subject of salts related to my question?
- If salts are used in generating this hash, and if salts are random, how the server side compares the hashes in their database, to the hash made from my user/pass+random salt?
It seems my questions are quite far apart in category, sorry about that.
This website I'm talking about has a history of mixed logins (though rare). Like when I login using my username/pass I accidentally go to another users session.
Where is the security weakness of this procedure? (which probably is the reason for the mentioned mixed-session logins)