1

how to create a login system that is still logged in (as long as user wouldn't click log out) although browser is closed?

when using $_SESSION , it was gone when browser is closed. So, we can use $_COOKIE, but it looks like less secure then session.

How yahoo, facebook, twitter or any site create their login system, so when user close the browser, it will stay logged in? Using IP? $_SESSION? $_COOKIE? or what?

Thank you

5 Answers 5

2

You can set the lifetime of a session cookie. By default it's on browser close. You can do this in php.ini or look at http://php.net/manual/en/function.session-set-cookie-params.php

3
  • Session cookies always expire when the browser is closed. That's the definition of session cookies.
    – Oswald
    Jun 23, 2013 at 3:11
  • Interesting, then maybe combination of both setcookie and long lived session.
    – Faisal
    Jun 23, 2013 at 3:15
  • no session, just long lived cookie, you use the cookie to save a custom session key
    – Matt Clark
    Jun 23, 2013 at 3:15
2

Encrypt the necessary information in a cookie when a user has logged in. When they visit your site decrypt the cookie to get your information.

Another security measure would be to use a database to validate the cookie. This would help with some security. I am not a security expert and there are other security measures you should probably still think about, but this should help you get started.

2
  • i use mcrypt for password.. so i should keep the encrypted to the cookie? Would cookie keep encrypted character well? Jun 23, 2013 at 3:20
  • Don't store the encrypted password in the cookie. In the cookie store the necessary session information that would probably validate against the database and if the two match it's a valid session. Then show the user your view with them logged in. That's one way.
    – Nick
    Jun 23, 2013 at 3:25
2

Make sure that you do not use a session cookie to identifiy sessions. For that, use session_set_cookie_params() to give the cookie a longer lifetime.

Make sure that sessions have a long timeout. This can be done by adjusting the value of the session.gc-maxlifetime configuration option.

3
  • not use a session cookie? how to do? im very new in php. and long time out? Jun 23, 2013 at 3:10
  • Sessions on the server are usually identified by a cookie. Cookies come in two flavours: 1) session cookies (valid as long as the browser is open) 2) persistent cookies (valid as long as you specified when setting the cookie). Use persistent cookies to identify sessions.
    – Oswald
    Jun 23, 2013 at 3:18
  • Thank you very much @Oswald , i would search about 'persistent cookies' after this Jun 23, 2013 at 3:21
2

It looks like StackOverflow and Youtube use Local Storage.

Unlike cookies, the local storage has no expiration date, but when the user logs on or does something that changes something on the server, you will need to manually send the data in the local storage to the server to verify(via XHR or some other way of communicating). When the user logs out, call window.localStorage.removeItem() with the key you save the login information under.

0
1

As stated by Oswald, do not use $_SESSION, as this ends when the browser closes.

Session variables are stored as cookies, so creating your own is not less secure.

When creating your own COOKIES, you should set the expiration to be a long time, like a year or so, to ensure that the cookie does not expire, and the user will stayed logged in.

A vast majority of production sites use cookies for session keeping, just make sure that your session keys are random enough that can not be guessed by another client.

EDIT

See this link on how to use setcookie.

setcookie("session_key", "somerandomstringrepresentingasessionkey", time() + 60*60*24*120);

The following will set a session key for your website with the name session_key, this is how you will fetch the data at runtime:

$session = $_COOKIE['session_key'];

The next part is where your value will be stored, this will be the session key that you will store in the database to be fetched and matched with the user, what the value of $session will now be.

The next part is the time until it expires, here i have put 60 * 60 * 24 * 120, meaning that the current time, plus 60 seconds, times 60 minutes, times 24 hours, time 120 days. Meaning that in 120 days from that exact moment in time, that specific cookie will expire, even if the browser is closed before that.

5
  • $_SESSION does not end when the browser closes. It ends when it is deleted by the PHP session garbage collector.
    – Oswald
    Jun 23, 2013 at 3:13
  • @Oswald , but i will not accessible when browser is closed right? Jun 23, 2013 at 3:16
  • Depends on the lifetime of the cookie that is used to identify the session.
    – Oswald
    Jun 23, 2013 at 3:19
  • @MattClark , going to try this solution. Thank you Man Jun 23, 2013 at 3:28
  • Not a problem, hope I was able to help. Happy coding!
    – Matt Clark
    Jun 23, 2013 at 3:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.