User login with cookies

Thanks for the prompt response but I'm looking for someone to explain some security issues and the right method of storing the cookies first before I check them at login time.

Tony

Either way, I don't want to send them to a login page if they don't have login info stored in their cookies. It's a "bonus" if they are logged in because then they will see other features on the menu and will be able to access the message board.

With regards to security:

The only way to secure it 'properly' would be to store the information in a database on a server with SSL (https). If you store the information in a cookie, or in an unsecured database on the server, when the information is passed across the internet it will basically go as plain text! (even though it will appear to be asterixed out).

So the short (and sweet) answer is that without some form of certification/security - you'll always be passing the information as plain text.

If you want to read more information about IIS security methods, here's a fairly simple article:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnw2kmag00/html/iis5auth.asp

Here is (oversimplified) a "bonus" system

<p>This content id for everybody</p>

<%If Request.Cookies("Logged") = "Yes" then%>
       <p>This is the special bonus content</p>
<%End If%>



Note about security: As you can see, in EE cookies there is no password stored.

tony3x said:

> Note about security: As you can see, in EE cookies there is no password stored.


Then how does EE work so that I'm automatically logged in? I never type in my password.  I'm lost! :(

Take a look at your "Cookies". you will find something like:

Cookie-name:
Cookie:YOURCOMPUTERNAME@experts-exchange.com/

Cookie-content:
EELOGIN
YOURUSERNAME:XXHy8MRELwdIM
experts-exchange.com/
1536
579117440
34567610
1169827440
29567610
*

Look at the expire date of the cookie. That day you will need to log-in again.

Delete the cookie and then you wil need to re-login inmediately.


The password, if stored, (maybe then characters after YOURUSERNAME:) is obviously encrypted.

This is how RR knows who you are (well, not exactly you, but your computer)

Basically what happens is that your password will be stored in database somewhere. When you login to Experts Exchange, it checks that the username you've supplied matches the password held against that username in the database. If it does match, it puts a cookie on your machine saying effectively, user bloodtrain=true.

So each time you come back it can see that you're username is bloodtrain, and that the you've already supplied a suitable password.

It's straightforward to do.

But it still comes back to the point that the only way to do this 'securely' is with SSL or suitable additional security.

I don't know, this is all getting to confusing.  :)

You know what, either way, I don't need the highest security on my site.  It's not like I'm storing creditcard numbers.  So, basically, I guess all I need is to just encrypt the password a little so atleast the average person can't figure it out.

Now, I'm a total novice at this stuff.  From what I read on the net, there is basically 2 ways to encrypt: using regular ASP or making a COM (which I don't even know what it is but looks confusing)! :) Does anyone have a link to tutorial that beginners like me will understand?  I don't know anything about hex numbers and blah blah blah! :)

Thanks

btw: sorry that I don't understand! :(