3 ms·
So I assume if you use bcrypt, you only verify the password once upon login, and then store a cookie that verifies the user is logged in? That brings other secu
by Tichy 15y ago
So I assume if you use bcrypt, you only verify the password once upon login, and then store a cookie that verifies the user is logged in? That brings other security risks.
But the alternative seems to be to make every request very slow, because it would require bcrypting the password with every request.
- brown9-2 15y agoIf you were to re-authenticate the user on every request, how do you have the client send the password to the server on every request without making the user enter it every time?
- Tichy 15y agoBy storing it in a cookie - oh :-) I suppose you could come up with some scheme where you create a new cookie with every request, a kind of one-time cookie to prevent session hijacking. Probably not worth it and not 100% reliable, though. I guess just trusting in cookies is the only real option. Or HTTP BasicAuth, it sends the password with every request I think (unencrypted, I know). In either case in theory you need HTTPS.