Quote:
Originally posted by Darth Cow
Good idea, but your method isn't very secure - one can simply edit the time in the cookie. I think that encoding the time into the password part of the cookie (used for authentication) would be the most effective solution, but that would require storing each of the valid login times for each user in the database (you couldn't do a simple numerical comparison because the password/date would be MD5'd).
|
Well, you're right, but the encryption, that would be used, has to be two-way, because it needs to be checked, if the cookie is older or newer, than lastlogout.