Posted by Øystein Hafli on 01/04/06 03:40

Marcos José Setim wrote:
> Hi,
>
> I've like to know if exists tips for developing the login using Session
> and Cookie to secure against invasion.
>

You can use a fingerprint function:

--
function fingerprint($username) {
$fingerprint = $username . $_SERVER['HTTP_USER_AGENT'];
$fingerprint = $fingerprint . "saltword";
$fingerprint = md5($fingerprint . session_id());
return $fingerprint;
}
--

When the user logs in:
$_SESSION['fingperprint'] = fingerprint($_SESSION['username']);

then, on the secured pages, do this:
if($_SESSION['fingerprint'] != fingerprint($_SESSION['username']) {
echo "Fingerprint mismatch";
session_desotry();
exit();
}


I got this from an article/a post at http://shiflett.org/, but I can't
find it. It's not bulletproof, but it's an extra measure :)

[Back to original message]