2

I am building a forum and I am not sure about the best practices of setting up a cookie.

Here is the cookie that I build as user registers the site:

       setCookie($name,$ip,time()+300000,"/");

instead of this: time()+300000. I want the cookie last forever, but I am not sure how to do it.

Also, I have a question regarding on security. how do I check that the cookie wasnt tampered or set by a hacker?

Another question, how do I check if the user allows cookies on his browser?

UPDATE:

I put this as soon as login validation is valid: setCookie($name,$ip,time()+60*60*24*365,"/");

UPDATE:

        if(!isset($_COOKIE['$name'])
        {
            $salt="[email protected]";
            $hash = SHA2(salt + $_POST['pass']);
            setCookie($name,$hash,time()+60*60*24*365*50,"/");
        }
4
  • Technically that cookie will last forever as it'll be reset on every page call and be refreshed - as long as the page is called at least once every 83 hours or so. For longer durations set a longer expiry date.
    – CD001
    Oct 24, 2011 at 11:51
  • that is not true. cause I set it only once the user registers
    – Matrix001
    Oct 24, 2011 at 11:54
  • Oh - and if $ip refers to the user's IP address to identify them... that won't work very well in reality. IP addresses are nowhere near static enough to work as an identifier in the long run.
    – CD001
    Oct 24, 2011 at 11:58
  • so should I compare to his email? or password instead?
    – Matrix001
    Oct 24, 2011 at 12:08

4 Answers 4

2

For duration, just use a big enough number instead of 300000.

time() + 60 * 60 * 24 * 366 * 15 gives you 15 years.

To prevent tampering, use a secure hash function (like SHA-2), store a secret salt (a 256-bit random string, for example) on your server, compute hash = SHA2(salt + data) and set a cookie that holds hash.

Now, when you read the cookies, all you have to do is verify that hash has the correct value.

3
  • doesnt it add a burden on the server? the hash?
    – Matrix001
    Oct 24, 2011 at 12:04
  • Not much more than cookie verification itself. How many users per day are we talking about?
    – Dennis
    Oct 24, 2011 at 12:06
  • Hashing 1000 short strings takes less than a second.
    – Dennis
    Oct 24, 2011 at 12:23
1

Cookies are this way. They can be changed by anyone. You can use Sessions to be more secure, or check cookies values every time you use them to make sure they did not change.

You also can encrypt them, but cookies has characters limits and encrypting will make it bigger, so it's not a great sollution.

About the "ever lasting cookies", you can set like 50 years to expire.

3
  • is this the way to do it?:setCookie($name,$ip,time()+60*60*24*365*50,"/"); I can use that statement again and again with every time the user logs in.will it add another cookie? or will override the existing one
    – Matrix001
    Oct 24, 2011 at 11:59
  • Integer size is platform-dependent. With 32-bit integers, you can't set a cookie to last 50 years.
    – Dennis
    Oct 24, 2011 at 12:14
  • 1
    @Matrix001 If cookie exists with the very same name, it'll overrite not create another
    – gustavotkg
    Oct 24, 2011 at 12:23
1

You can not set a cookie for ever, but you can set it for a very long time and refresh it anytime a user is visiting your site.

To the second part: save the cookie values additionally in your database, and if they match you set it, if not someone tried to manipulate something.

Another option would be that you only store an identifier in the cookie and the values in your database. But be careful and make sure noone can guess those identifiers.

Btw: I don't think the user's IP has to be stored in his cookie for ever, beacause most people would need a new everlasting cookie every day :-D

UPDATE:

It is not good to use the users ip for identification, it changes every day. Do it like this: save a salt for every user in the database. Generate it randomly like "jfdklsjfdsohfdsughfdjkhg". If user logs in save cookie "LoggedIn" with the Value md5($username.$salt) additional to a cookie saving the users id. If You read the cookie you only have to compare the hash with md5(databaseName.databaseHash). If it is equal, the cookie is good. You have to be sure the salt is well protected in this system (only your system should know it).

if(isset($_COOKIE["LoggedIn"))
{
    $userid = $_COOKIE["UserId"] // Second cookie, not hashed to know the user's id
    //get Values from Database here => $database_name, $database_salt
    if(md5($database_name.$database_salt) == $_COOKIE["LoggedIn"])
    {
         //OK
    }
}
2
  • well, do I make that validation with every page the user travels to?
    – Matrix001
    Oct 24, 2011 at 11:53
  • If that needs to much power you could at least compare some simple checksums, md5 does not need much power these days. And yes, make it on every visit. The most simple approach is to write your own read/write cookie function wich sets/reads the cookie and checks/updates the database.
    – Tokk
    Oct 24, 2011 at 11:57
0

You cannot set a cookie forever. You can set a long expiry for a cookie. Please save data in your db or session and try to match them. It is recommended to use session than using cookie, session data cannot be modified.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.