I'm experimenting with security, cryptography and web applications. My aim is to create simple login system that is realy secure enough. I'd like to share my approach to keep authenticated session with you to get some comments.

My approach:

When te user signs in (I use BCrypt and password_verify):

$_SESSION['session_token'] = mcrypt_create_iv(16, MCRYPT_DEV_URANDOM);
$app->setCookie('auth', hash_hmac("sha256", $_SESSION['session_token'].$_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_USER_AGENT'], SESSION_SECRET));

All the cookies are encrypted with MCRYPT_RIJNDAEL_192 in CBC mode (Slim framework takes care of it).

Then, at every request I perform those checks:

    $token = $app->getCookie('auth');
        || !isset($_SESSION['session_token'])
        || hash_hmac("sha256", $_SESSION['session_token'].$_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_USER_AGENT'], SESSION_SECRET) !== $token
    ) {
         // user not logged in

SESSION_SECRET is my defined random const string.

And here is my logout function:


Is it secure enough in the matter of keeping user signed in?

  • 1
    Slim has a built-in session cookie store. Please use that rather than hand-rolling your own. – Stephen Touset Mar 27 '14 at 1:03
  • 1
    Although I highly recommend setting the secure and httponly flags to true, while their documentation inexplicably demonstrates the opposite. – Stephen Touset Mar 27 '14 at 1:04
  • If your user remains "logged" in, and goes to another IP address (wifi <-> 3g, or renewed his external IP, ....), or when he upgrades the browser, you'll end his session? – ndrix Mar 27 '14 at 5:27
  • What would in your case be "really secure enough"? If you have nothing to protect and would merely like to "keep user signed in" then I guess it's good enough. Please clarify. – TildalWave Mar 27 '14 at 7:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.