I reckon the best method of identifying a user is send an arbitrary token to the browser, and storing the token (server side) against the user_id.

One of the no-no's in web based applications is storing user data on the client, encrypted or not. The reason for this is you have no control over the information once it has passed to the client.

For example, if you are writing an applicaiton and send a session id to the client that is a two way operation, someone could sniff the packets, grab the information and reverse it. Once they have reversed it they may hijack the session. What you dont know are the resources your attacker has (They may have a cluster of E15k's at their disposal).

If you use a what is considered a one way function (such as MD5 or SHA-1) it is relatively impossible for an attacker to derive the meaning of your id. If you then store your generated sess_id along side your user_id at the server, you have complete control over the information. Identifying the user is as simple as looking the sess_id up in a database.

OTHO if your attacker has a cluster of E15k's you've got a bigger problem on your hands.. ;-)

In reply to Secure Session management (was Crypt::DES returns same string) by Ryszard
in thread Crypt::DES returns same string by learn_forever

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.