etrader Posted October 31, 2011 Share Posted October 31, 2011 I've read lots of articles and discussions about security issues for using session for user authentication; but I did not come to an explicit conclusion which is the best method. I decide to generate two session parameters (1) ID (2) a randomly generated Access Token which is stored in the database. I want to add more security: 1. Where to store session? server-side or client-side by session session.use_only_cookies ? 2. Is it good to check IP and User Agent before authentication by session? In this case I will lose the option of Remember Me as IP can be changed. 3. Which of the session parameters of http://php.net/manual/en/session.configuration.php is more practical to have a good security? Any additional idea? Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.