Managing LOGGED_IN state on website with SESSION & COOKIE - php

Question

I am currently working on a website and I am having hard time understand how can I make a secure and flexible system where I can manage user's logged in state.
I am aware of $_SESSION and $_COOKIE and I understand how they work, however, I can't find a way to use them properly.
Here is a piece of code that I built for keeping track of whether the user is signed in or not.
state_handler.php
include_once(__DIR__ . '/../setup.php');
include_once(COOKIE_UTIL_PATH);
include_once(SESSION_UTIL_PATH);
if (is_session_set() === FALSE) {
if (is_cookie_set() === TRUE) {
include_once(DB_PATH);
$data = get_cookie_data();
$user = select_user_by_username($data['username']);
if (!$user || strcmp($data['password'], $user['password']) !== 0) {
destroy_cookie();
header('Location: /index.php');
exit();
}
session_start();
set_session_params($user);
$new_data = array(
'username' => $user['username'],
'password' => $user['password']
);
create_cookie($new_data);
} else if (strpos($_SERVER['REQUEST_URI'], '/src/signin/signin.php') === FALSE) {
header('Location: /src/signin/signin.php');
exit();
}
} else if (strpos($_SERVER['REQUEST_URI'], '/src/signin/signin.php') !== FALSE) {
header('Location: /index.php');
exit();
}
cookie_util.php
function create_cookie(array $data): void
{
setcookie(
'user_information',
json_encode($data),
[
'expires' => time() + 1296000,
'path' => '/',
'httponly' => true,
'samesite' => 'Strict'
]
);
}
function is_cookie_set(): bool
{
return isset($_COOKIE['user_information']);
}
function get_cookie_data(): array
{
return json_decode($_COOKIE['user_information'], true);
}
function destroy_cookie(): void
{
setcookie(
'user_information',
'',
[
'expires' => time() - 1296000,
'path' => '/',
'httponly' => true,
'samesite' => 'Strict'
]
);
setcookie(
'PHPSESSID',
'',
time() - 1296000,
'/'
);
}
session_util.php
function set_session_params(array $params): void
{
if (!isset($_SESSION)) {
session_start();
}
$_SESSION['id'] = $params['id'];
$_SESSION['username'] = $params['username'];
$_SESSION['password'] = $params['password'];
$_SESSION['name'] = $params['name'];
$_SESSION['surname'] = $params['surname'];
$_SESSION['group_id'] = $params['group_id'];
$_SESSION['team_id'] = $params['team_id'];
$_SESSION['city_id'] = $params['city_id'];
}
function is_session_set(): bool
{
if (!isset($_SESSION)) {
session_start();
}
return isset($_SESSION['id']);
}
function destroy_session(): void
{
if (!isset($_SESSION)) {
session_start();
}
session_unset();
session_destroy();
}
Once user signs in, he is sent a cookie with his Username and Password(hashed with MD5).
This cookie will live for 30 days. If the session expires, I then extract data from the cookie and compare it with DB data. If it works, then I simply start another session and refresh cookie's lifetime.
However, after giving it a bit more thought, this solution is quite problematic.
I am storing user's credentials (doesn't matter hashed or not) in cookies, which I think is a safety hazard.
I have no way of terminating user's logged in state as an admin. Even if I delete him from DB the user will stay active until the session expires, which is not something I want.
What would be the correct way of solving this? I've been doing this for a little more than a month and don't have lots of experience with website development, so please, help me out here.

Answer 1

One of the most important rules in web programming is never trust any information sent by the client (browser).
Although you have code to set the cookie, the value you see on the next request is not under your control: there is nothing to stop the user pressing F12 in their browser, and setting the cookie themselves.
This is why the concept of sessions was invented: the cookie you send to the browser is just a random ID, and the browser can neither read nor write the actual data you've associated with that ID.
So:
Don't set a custom cookie, just use the session; PHP will manage the cookie for you
You don't need to store the user's password, hashed or otherwise, to know that they're logged in
Even once a user's logged in, you can check in the database as often as you like to see if they've been disabled; this might be every request, every 5 minutes, or every time they do something particularly dangerous
Some very rough code, which you should read as an example not just copy and paste might look like this:
session_start();
if ( isset($_POST['username']) && isset($_POST['password']) ) {
$user = select_user_by_username($_POST['username']);
if ( password_verify($_POST['password'], $user['password_hash']) ) {
$_SESSION['login_successful'] = true;
$_SESSION['login_expires_at'] = strtotime('+30 minutes');
$_SESSION['user_id'] = $user['id'];
}
}
if (
! $_SESSION['login_successful']
|| $_SESSION['login_expires_at'] < time()
|| user_is_disabled($_SESSION['user_id'])
) {
redirect_to_login_page();
exit;
}
// Extend the login to be 30 minutes from last activity, not 30 minutes from login
$_SESSION['login_expires_at'] = strtotime('+30 minutes');