Re: Correct Session Authentication

[Siim Põder <siim.poder_1398 () eesti ee>]

Yo!

On 29.07.2006 16:14, xbennx () hotmail co uk wrote:
> When a user logs on, the username and password are sent via SSL and
> the md5 hash is then checked against a hash stored in database. If
> the credentials are found in the database, the users id is return and
> stored in a session. If the credentials are not found this session
> value is 0. Every page that a user needs to be authenticated to see
> checks to see that the user id stored in the session is greater than
> 0, if not the user is classed as not authorised as 0 is not a valid
> user id.

Do you mean that when the credentials are not found, the *user id* 
*stored in session* is set 0?

> Is this method secure or can it be easily bypassed?

The general method is fine, but there are hurdles that have to be 
watched out for in the implementation.

> Another thing I was wondering is where are sessions values actually
> stored? I've read that they're stored in cookies but I always thought
> there was a seperate function in php to create cookies?

As far as I know it should be configurable and could be in a temporary 
file, memory or a database.

> Sorry this is so long, any help will be much appreciated.

Size doesn't matter. It's what you write and how you do it.

--
Siim Põder

The argument goes something like this: `I refuse to prove that I exist,'
says God, `for proof denies faith, and without faith I am nothing.
`But,' says Man, `The Babel fish is a dead giveaway, isn't it? It could
not have evolved by chance. It proves you exist, and so therefore, by
your own arguments, you don't. QED.'
`Oh dear,' says God, `I hadn't thought of  that,' and promptly vanished
in a puff of logic.
`Oh, that was easy,' says Man, and for an encore goes on to prove that
black is white and gets himself killed on the next zebra crossing.
        -- Douglas Adams

-------------------------------------------------------------------------
Sponsored by: Watchfire

AppScan 6.5 is now available! New features for Web Services Testing, 
Advanced Automated Capabilities for Penetration Testers, PCI Compliance 
Reporting, Token Analysis, Authentication testing, Automated JavaScript 
execution and much more. 
Download a Free Trial of AppScan today!

https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------