// Generate current device's token $token = substr(bin2hex(mcrypt_create_iv(200)), 0, 60); // Include this device's token $STH = $userDB->prepare("INSERT INTO devices (user_id, token, active) VALUES (?, ?, 1)"); $Res = $STH->execute(array($Id, $token)); if (!$Res) throw new Exception("Couldn't store the device in the database"); // To keep users logged in between sessions $Cookie->email = $email; $Cookie->token = $token;
However, this implies that if the database was stolen, the attacker would be able to log in as anyone by changing the cookies. This is an issue I want to avoid. I know that
sha256 is not valid for general password hashing. However, from the string this comes from,
$token = substr(bin2hex(mcrypt_create_iv(200)), 0, 60);
Is it secure to store a
sha256 hash of the high entropy token in the database? Or should I be using the more expensive bcrypt, as with the passwords?