Cookie + db token + session authentication, can i do away with the sessions

I have a little web app, which uses a lot of ajax. After someone logs in, what we need to keep persistent is their user_id and group_id

The way I first did authentication, I just stored these as clear txt in cookies ( $_COOKIE['user_id'], $_COOKIE['group_id'] ). Obviously that was bad since you could modify both values!

I'm not an experienced programmer and don't need massively amazing security for this app. But that was pretty bad.

So, I moved on to creating a token in the database, which stores the user_id, group_id and a hash token and t开发者_运维知识库hen putting that token only in the cookie. The user_id and group_id are created as sessions once the token is authenticated (cookie match database).

This is more secure but the whole thing of having to manage the user_id and group_id sessions (timeouts, reinitialising) vs just grabbing them from cookies has caused a lot of grief and made my app's actual functioning less reliable.

Now accepting my level of skill, and that the easy management + robust functioning of my app is more important than high level security... I'm wondering if I could do away with the sessions, and do a compromise by still storing the user_id and group id in a cookie but along with the hash - i.e.

COOKIE['token'] = user_id_val+group_id_val+hash_in_db

would look like: 23-144-jhwr8324398fjk2j49083223n23

So all I need is a little function to parse that string and do everything from that. Someone could change the values but obviously the hash won't match.

Is this ok?

---

You don't need cookies at all (well, except for the session cookie) for authentication. Here's an example of a simple cookie-less authentication:

session_start();

// $db is a pseudo object for database access

// Verify login
$auth = false;
if (isset($_SESSION['user_id']) && isset($_SESSION['user_hash'])) {
   $user = $db->getUserById($_SESSION['user_id']);
   if ($user) {
      $hash = sha1($user->id.$user->salt);
      if ($hash === $_SESSION['user_hash']) $auth = true;
   }
}

// Make login
if (isset($_POST['login'])) {
   $user = $db->getUserByCredentials($_POST['login'], $_POST['password']);
   if ($user) {
      $_SESSION['user_id'] = $user->id;
      $_SESSION['user_hash'] = sha1($user->id.$user->salt);
      // redirect...
   }
   // redirect to error page
}

Of course, this can be improved to add defence mechanisms against all sorts of attacks, store user information, etc. but this is the basic idea. It's way more secure than using cookies.