10

How do you implement this in CodeIgniter?

6 Answers 6

33

(This answer was a response to the original question)

How would you do this ? Or, how would you create a session with a longer expiration date than the others ?

All created sessions would use the same $config['sess_expiration'] in the config file (default: 7200 seconds), is there a way to pass a custom value ?

Extending the expiration of a session cookie isn't going to work for a "remember me" feature, since the user will lose their session cookie when they close the browser. If Code Igniter doesn't have a native "remember feature", then you'll need to write something to drop a long-life cookie which contains information which will allow an automatic login when the server sees it again.

There's a good article on Persistent Login Cookie Best Practice, which can be summarized as:

  1. When the user successfully logs in with Remember Me checked, a login cookie is issued in addition to the standard session management cookie.2
  2. The login cookie contains the user's username and a random number (the "token" from here on) from a suitably large space. The username and token are stored as a pair in a database table.
  3. When a non-logged-in user visits the site and presents a login cookie, the username and token are looked up in the database. 1. If the pair is present, the user is considered authenticated. The used token is removed from the database. A new token is generated, stored in database with the username, and issued to the user via a new login cookie. 2. If the pair is not present, the login cookie is ignored.
  4. Users that are only authenticated via this mechanism are not permitted to access certain protected information or functions such as changing a password, viewing personally identifying information, or spending money. To perform those operations, the user must first successfully submit a normal username/password login form.
  5. Since this approach allows the user to have multiple remembered logins from different browsers or computers, a mechanism is provided for the user to erase all remembered logins in a single operation.

Another article which builds more security onto those ideas in Improved Persistent Login Cookie Best Practice

If you follow the practices in those articles, you won't go far wrong!

4
  • yup, good article but not exactly what I'm looking for. What I want to know is a way to do that particular task (setting up a longer session than the other ones) in CI :D
    – andyk
    Jan 7, 2009 at 11:19
  • Extending the expiration of a session cookie isn't going to work for a "remember me" feature, since the user will lose their session cookie when they close the browser. If Code Igniter doesn't have a native "remember feature", then the ideas presented above will help you implement one.
    – Paul Dixon
    Jan 7, 2009 at 11:48
  • okay, now I see the flaw in the question. It should be "How do you implement this in CI?". Silly me. I'll wait a bit before going with your suggestion. Thanks Paul.
    – andyk
    Jan 7, 2009 at 12:21
  • CodeIgniter now has a sess_expire_on_close setting. Theoretically, if sessions are being stored to database via sess_use_database, it would be possible to set sess_expire_on_close = FALSE and use a large value for sess_expiration to keep a session active even after the browser window is closed. Is this doable and secure in practice though? Jan 26, 2014 at 14:03
3

You might want to reconsider the suggestion from 'Improved Persistent Login Cookie Best Practice'. I've posted my analysis of the problem on the site, but the gist of it is this:

You can not prevent cookie stealing without a secure line, no matter what

(*By 'secure line', I mean SSL / VPN tunneling / public-key encryption - or a robust challenge-response scheme *)

I'm all for persistent login best practices, but there's a point where no amount of trickery is going to help, and where the only way up is SSL.

6
  • Interesting. Which one is your analysis ?
    – andyk
    Jan 25, 2009 at 18:58
  • The last one, posted in the name 'Jens Roland'. It should be on the second page of comments (jaspan.com/…) Jan 25, 2009 at 19:05
  • 1
    SSL doesn't really solve anything. Background info: fishbowl.pastiche.org/2003/10/20/whats_your_threat_model The majority of attacks against cookies are either XSS, browser bugs or compromising the client. Setting httpOnly fixes XSS (no SSL Required), and SSL does nothing to fix the others. Jan 29, 2009 at 2:14
  • Even if it is in no way foolproof, SSL still has a better-than-average chance of thwarting the #1 attack mode (interception over the wire). #2 and #3 are just plain game over and beyond the scope of an authentication measure, and as you said, httpOnly fixes #4. Jan 29, 2009 at 5:40
  • 1
    You're just paraphrasing what I quoted in the aforelinked post: "Well, in a nutshell, we won't protect against the end system attack, because its really difficult. And we'll ignore DOS because that's too difficult too. But we'll cover the entire on-the-wire threats… because… we can!" Feb 3, 2009 at 23:00
1

Thanks for the solution. I have implemented this into my CI project.

DEV Note: the cookie should have a secured-hash as the remember-me key. - do not just store a user-id) - do not store a password, - and do not store hash of password. That way people can't automatically log into any account.

Worst case scenario: As soon as a hacker discovers the hash method, you can adjust the key producer function in one place and you are set up again with security. I would just adjust the salt and pepper strings.

Hope that helps. Chris D. - from Australia :)

0

For these things, the CI variables in all classes can be accessed by its own library:

For example:

$this->session->sess_expiration = 500000;

Hope that resolve your problem.

0

there is library on github for remember me download it.

Using this library's setCookie() function, the following occurs:

1.A cookie is generated containing a unique number This number is recorded into a database table, called ci_cookies along with the netid/username passed on to setCookie()

2.When the verifyCookie() function is called the browser's cookie hash must match the hash recorded to the database. If it does, verifyCookie() returns true forward it on home page

1
  • Please link to the library in question.
    – Ry-
    May 12, 2012 at 13:52
0

U need set conf before load session

$do_not_remember = (boolean) $this->input->post('do_not_remember');
if ($do_not_remember) {
   $this->config->set_item('sess_expiration', 0);
   $this->config->set_item('sess_expire_on_close', true);
}
$this->load->library('session');

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.