I have recently been challenged with coming up with a Login framework which holds user data in a separate database which I connect via a SOAP connection. Now, I have done something along these lines before using only MySQL.
Now to come up with the login system, I store the user info returned in
$_SESSION variables; They return the password in plaintext (along with some other information) - not sure why - however, I do not store that password in plaintext; rather I encrypt the password with an unique key for each user.
To check if the user is currently connected I use their sessions using 2 different parameters hashed together and compare to the
logged_in__string which is done at log in; this is the basic setup:
$_SESSION['logged_in__string'] = hash ( 'sha512', 'USER_PASSWORD' . $_SERVER['HTTP_USER_AGENT'] );
After I create that, I encrypt the password using an unique key for each user; Then create a new function,
check() which will decrypt the password, and create the hashed value compare it to the
$_SESSION['logged_in__string'] and if equal then user is logged in.
My interest is in the
$_SESSION variables. What are some potential risks in the approach I have taken, and if there are any, what are some good methods to secure these sessions for the user.