The question is the following, let's say I am authorizing the user on the site and in case of successful authorization I set cookies (setcookie ('auth', 'yes', time () + 3600);). This cookie for example gives access to a closed part of the site. So, is it possible to create cookies on the user's machine and bypass this restriction?

  • one
    You can create such a simple cookie yourself without any tricks. - Visman
  • Basically, they use an arbitrary point that binds to the user session, and write to the cookie, something like setcookie('auth','dbd4d5171a44361bc4d122f256e7c555',time()+3600); , but I want to say rather that cookies are stored in the user's browser and it must be taken into account that the user can change the cookie or create a new and trust cookie cannot, in general, like everything the user sends !!! - users
  • In general, I would advise you to start learning from the Web Framework, let's say laravel.com , read the documentation and study it, it will just take care of your authorized users and which pages you should not show it - users
  • one
    @users, cool :) To put a cookie safely, you need to learn / use laravel! - Visman
  • Yes you can. Better use session - woyadagiw

1 answer 1

You can create it yourself, you can transfer it from another machine, you can attach it to HTTP traffic.

The easiest way to fix user authorization is to use sessions. Then, the user stores only the session identifier, and the authorization status is stored on the server.

If sessions are not satisfied with something, then a similar mechanism can be implemented.

  1. We generate some random number
  2. Write it to the database for this user. In the same place in the database write the login time
  3. We send the user two cookies with the identifier (or login option) of the user and the generated number.

When the user connects, we check

  1. Do you need cookies?
  2. Do the numbers sent by the user and recorded in the database
  3. Has the login time expired

If everything is OK, then the user is allowed, the login time and cookies are updated. MD5 hashes add to taste

  • Do not tell me where to dig about the restrictions for viewing part of the site? where to dig? what to replace this cookie? - Dmitriy
  • @ Dmitry Wrote an approximate algorithm - Anton Shchyrov
  • IMHO, but it is better to use a string, not a number, session id for resetting it, and information about the user's browser. - users
  • ok, thanks, let's try to implement. - Dmitriy