I'm a PHP web developer who has been reading up on security recently and consequently this question entered my mind: How to properly and securely authenticate already-logged in users with a token? I've seen the technique mentioned several places, but I haven't found a demonstration of it.
I implemented a version of it myself that works like this:
- The user logs in using his username and password. (Stored using a 1024-bit pbkdf2 hash)
- A random token is generated then MD5'ed using the following PHP code:
- This information is stored in the database, a PHP session, and a cookie.
- When the user accesses a page, a function is called that checks whether the token in the session or cookie matches the token stored in the DB. If it does, the user stays logged in, if not, the user is logged out.
- Every time a request is sent to the server, this function is called and steps 2-3 are repeated.