IT350: Web & Internet Programming Set 16: Sessions Logging In - - PDF document

1

IT350: Web & Internet Programming

Set 16: Sessions

Logging In Correctly

2

Logging In Correctly

• Unique session IDs identify your client
• No other client who has connected to the website

should have the same ID

• With proper encryption, nobody else knows your ID.

Authentication

• Get username/password from user
• Check in file/db that correct combination

– Never store plain text passwords

• Hash
• Salt
• Iterate hashing
• Set session variable
• Later see if session variable is set – if yes, it

means “authenticated” user

3

Sessions in PHP - Create

session_start() $_SESSION[‘username‘] = ‘test’;

Sessions in PHP – Read and Delete

session_start(); if (isset($_SESSION[‘username’])) $user = $_SESSION[‘username‘]; unset($_SESSION[‘username’]; session_destroy();

4

Session management

• Session token should be random

– session_id() gives you the id of the session

• Cookie

– No expiration date set - so expires at end of browsing session – secure – only send over https – HttpOnly – cannot be accessed from JS

Exercise

Look at login.php and read.php on the calendar and mope. Edit your team’s login PHP to use sessions. If you don’t have a login yet, make it!