Security Safe PHP Session Setup

[waugh]

I am working on a totally new from scratch Member Login system, and am looking for the overall best PHP Session Authenticating setup to use.

CURRENT SETUP
1. Visitor comes to login

2. The login page creates a md5(rand()) number set as a token

3. Visitor gets a SESSION[token] set as the random token from step 2.

4. A hidden form field gets created with the token as the value.

5. Visitor enters username/password -> submits data

6. If the Hidden Field Token and the Session Token Match (it continues)

7. It then checks validation, making sure the member does exists, email and password was legitly typed, and if so (it continues)

8. Once it confirmed the member existed, and no SQL Injections are put in, it verify's the member username/password - if okay (it continues)

9. It creates a NEW token and replaces the current SESSION token, because it was s -- This message may have been cut off and the rest will only be shown to members. To become a member, click here --

[rutherford]

One thing I would have to say would help for setting the session token would be a combination of the following.

Username or UserID
IP
time()

That is what I have always used and never had an issue.

Hope I was of some help
Have a nice time -- This message may have been cut off and the rest will only be shown to members. To become a member, click here --

[zac]

If the user is behind a proxy or a server farm, their IP can and will change on each page request. One thing that stays pretty consistant is their User Agent string. If this changes mid session then it either isn't them anymore, or they are using something like Opera that allows these switches. Either way you can make 'em log in again -- This message may have been cut off and the rest will only be shown to members. To become a member, click here --