This is a solved problem

This is a solved problem

Posted May 8, 2008 13:00 UTC (Thu) by dskoll (subscriber, #1630)
Parent article: Cryptographic splicing makes for a Wordpress vulnerability

I don't understand why this has to be so complex. If you want to use cookies for authentication, you generate a strong random value and use it as the key into a session cache. The session cache can either be in the database or on some other storage mechanism if you're worried about SQL injection attacks.

---

(Log in to post comments)

The benefit of this method is that you don't need to keep any server-side state for sessions:
all needed information can be kept in the cookie, and the hash ensures the information can't
be forges.