Cookies, Sessions & Authentication

Cookies, Sessions & Authentication

1. HTTP Response and Request

   • Request
     • $_GET
     • $_POST
     • $_REQUEST
     • header($str)
   • Response
     • get_headers($url)
     • http_response_code()
   • HTTP Status codes
     • Let client know what status its request is
     • HTTP is stateless
       • Treat every interaction as a new request
         • No info passed from one to another
           • Cookies and sessions used to pass info between pages

2. Cookies

   • Cookie
     • Small pieces of info about user store on the user's computer
       • Sent by server to a browser, then sent back on future page requests
     • Consists of single name/value pair
     • Session cookie
       • Default type, temporarily stored only in browser's memory
     • Persistent cookie
       • Stored in a file on the browser's computer
   • When are they useful?
     • Authentication, user tracking and maintaining user preferences, shopping carts
   • Setting cookies
     • setcookie(name[,value, expires, path, domain])
       • Path
         • Availability of a cookie to other web pages on a server
       • Domain
         • Sharing cookies across servers in the same domain
     • Retrieving cookie info
       • Automatically assigned $_COOKIE super global
         • isset() checks if cookie is set
           • e.g. if(isset($_COOKIE["user"]))...
   • Limitations
     • Users can easily disable cookies
     • Easily deleted
     • PHP sets limit size on cookies
     • Must be set before you can send HTTP headers (request/response)
     • Less secure than sessions

3. Sessions

   • A session is a sequence of HTTP requests and responses between a browser and a server
     • Allow you to keep track of your users even when clients disable cookies
     • Server stores client's IP and local session data
       • Sends session ID back - PHPSESSID
         • Sent back on future requests
         • If users have cookies off, session ID passed as query string from page to page
     • PHP Session Variables
       • session_start() script to start session
       • $_SESSION global array
   • Consists of an ID, and data stored on the server (unlike the browser with cookies)

4. Authentication

   • Tell a web application who you are
     • Form-based authentication
       • Using standard HTML form fields, pass username, password etc.
         • Creates a session
     • Token-based authentication
       • Request to a server is accompanied by a signed token
         • Verify authenticity, only then respond

Imágenes y archivos del mapa