Each time a user goes to a new page in my CGI-based site, the script calls up a big lump of info about this session from a db. What I plan to do is, for a properly logged-on user, send with each page a field containing a randomly generated string. When that string gets submitted, the script checks it against the db; if there is a match, it pulls out the info, and then changes the random string and sends back the new string. If there is no match, then I know that this is not a logged in user.
I have a few questions about this:
Am I right in thinking this is more secure that htpasswd (if done properly) in that each "password" only exists for a single transaction in the session - my limited understanding, which may be wrong, is that this makes it harder to sniff than $ENV{'REMOTE_USER'}.
Is there any advantage in encrypting the random string? - it seems like there must be, but given that each string only gets used once, I can't see that it's any harder to spoof when unencrypted.
Assuming I shd encrypt it, what's your recommended encryption module - there seems to be a bewildering array of them in CPAN
In generaly, am I barking up the wrong tree (or just plain barking) with this? I'm pretty ignorant abt security, so please don't refrain from telling me something because you think I'll already know it!