|
Posted by Mike Roetgers on 02/16/07 10:27
monomaniac21 schrieb:
> hi
>
> i have a php site which allows users to save a cookie on their
> computer which stores their user id details and allows them to auto-
> login.
>
> i'm wondering whether this is safe, is it possible for a malicious
> user to find that cookie and change its value and therefore auto-login
> as someone else? and if so how can this be prevented?
>
> thanks
>
> marc
>
You could store one half of the user's password hash in the cookie. When
he come back, you compare it to the hash in the db. Works for me :-)
Navigation:
[Reply to this message]
|