|
|
|||||||||
|
|||||||||
|
|||||||||
| |
||
| |||||||||
![]() |
|
|
«
Previous Thread
|
Next Thread
»
|
Thread Tools | Search this Thread | Rate Thread | Display Modes |
|
#1
|
|||
|
|||
|
Hi,
I am currently working on a login system and is faced with the problem of my users being logged out upon session.timeout. This being a bit unfortunate if the user is in the middle of typing a post I am trying to work around this. I took up the classic 'Remember me' approach which is fine but have some issues which needs to be covered before proceeding. Anyways this is the following I have come up with, nothing new under the sun I guess but any suggestion or thoughts would be appreciated ![]() AUTOLOGIN CONCEPT Table fields `uid`,`pwd`,`salt`,`guid` and `username` uid: Holds the user's hashed username. pwd: Holds the user's hashed password: salt: Holds a random value. guid: Holds a random valued changed on every login. username: Holds the user's clear text username. MANUAL LOGIN 1. The user enter his username and password both of which will be hashed thus guaranteeing no 'special characters' to have impact on the comparing process. 2. The username will be compared to `uid` if there's a match `pwd` and `salt` are selected from the database. 3. `salt` is then added to the entered password which then is compared to `pwd`. 4. `guid` is updated with a new random value, the `uid` and the `pwd` all hashed into a single value, which also will be stored in a cookie. AUTO LOGIN 1. Upon entering authentication required page a cookie holding the `guid` is requested. If the cookie is not found user is redirected to 'Manual login'. 2. The 'cookie guid' is then compared to the `guid` in the database. If no match is found the 'cookie guid' is deleted and the user is redirected to 'Manual login'. 3. The user is logged on and the `guid` is updated with a new random value, the `uid` and the `pwd` all hashed into a single value, which also will be stored in the cookie. This is very sketchy so please tell me if you find my notes to confusing. |
![]() |
| Viewing: ASP Free Forums > Other > Programming Help > 'Remember me' function in login system. |
| Thread Tools | Search this Thread |
| Display Modes | Rate This Thread |
|
|
|
|