4 ms·

thanks. every time someone uses the password as input to some "secure" hash, i cry inside. why is the password even relevant to a user session identifier? it's

• ars 17y ago
  And the next time someone logs in as you, and clicks "keep me logged in" - and you have no way to un-log them in, you should also cry inside. If the password is changed, all session identifiers must be invalidated. If it's a session table, delete all entries, if it's a hash - well your hash had better include the password somehow (a hash of the password hash, i.e. the one stored in the db, is fine, as long as changing the password changes the final hash).
  • heresy 17y ago
    session lifetime is an orthogonal concern to the password. i just don't see it as a good idea to have the password be one of the inputs to the value of the session identifier in any way, which was my point. you can handle every scenario you bring up without tying password to session id.