Currently, the project login I am doing is just to determine whether the user session exists. If it exists, log in, if not, it will not log in.
Is this simple and crude method safe? How safe is it?
I don’t know what is the idea of designing a more mature and relatively simple login verification, please give me some advice
![[Web front-end] Node.js quick start](https://img.php.cn/upload/course/000/000/067/662b5d34ba7c0227.png)
The simplest login status is the session, and it is very safe.
Along with the session, there are cookies. Relatively speaking, it is not as secure as the session, but if it is set up, there will be no security issues.
Personally, I think the method of using
$_SESSIONto determine whether the user is logged in is unreliable.For example, after a user changes his password, how can the program make the old login invalid?
So it is still recommended to use cookies to verify the user's identity.
In the cookie Save the user's ID and salt.
When the user registers successfully, or when the password is changed, the salt is regenerated and the user table is updated.
session is relatively simple, but not reliable enough; if you need more reliability, you can refer to WeChat/QQ, and for more reliable information, refer to online banking login.
This is unreliable because the session is stored in the cookie and is the content of the client. In principle, the server should not trust any information from the client and needs to be validated. As for the verification logic, please design it yourself (just judging "yes" and "no" is obviously not enough)