123 reputation
4
bio website
location Italy
age 32
visits member for 2 years, 7 months
seen 13 hours ago

I'm a selftaught web developer, I'm graduated in Foreign Languages and Literatures but life takes you along unpredicted roads...So now here I am, from the beginning of 2010 studying and researching a lot to get up with the pace of those who dind't make the mistake of choosing a wrong path. I'm learning a bit more day by day, trying to do my best, making errors and small victories.


Apr
8
awarded  Popular Question
Dec
19
comment Did I understand the website “autologin” feature right?
Thanks for the answer. Now I see better where I was wrong. As for your 2 points: 1) that was my itention, I only messed up with practical distinction (see my various comments); anyway, now, with autologin active ad when "sessions" are expired, there's the autologin code (if the user didn't log out) which is by default set to 14 days (I also made some researches and came up to values of the like; I've seen the 2 weeks timespan being used more frequently than the month, though)
Dec
18
awarded  Student
Dec
18
awarded  Scholar
Dec
18
accepted Did I understand the website “autologin” feature right?
Dec
18
comment Did I understand the website “autologin” feature right?
That's what I intended to do, yes. Thank you for your time, @Yanis, I see things clearer now, wish I could +1 more! Cheers!
Dec
18
comment Did I understand the website “autologin” feature right?
As for session, the framework I use doesn't natively use php sessions but cookies on steroid. But it menages them like it were session, I mean, it provides a sess_destroy() method which destroys the cookies used as session while keeping any regular cookie, and a delete_cookie() which does the opposite.
Dec
18
comment Did I understand the website “autologin” feature right?
Oh, and I also have an expiration date saved in the DB, yes, just in case. Nice tip about checking ath each request; I actually do something similar on controller's constructor, but so far I'm separating session login check and autologin (first I see the former, when negative, see the latter. I might rework this, it seems)
Dec
18
awarded  Supporter
Dec
18
comment Did I understand the website “autologin” feature right?
Very nice answer!I understand the workflow, I just thought that "autologin" was...well, I don't know what I was thinking, actually...anyway, it's much more clear now, thank you! As for how I do it: 1) generate 16 chars random string (if available, with random.org) and hash it; 2) encode user_id and prepend to the random string; 3) save whole string to cookie; 4) save hashed random string of point 1) into DB; 5) Upon retrieval, split the cookie and get user_id and the random string; 6) fetch db autologin_code field where userid = user_id, hash random string and see if they match
Dec
18
comment Did I understand the website “autologin” feature right?
@Morons yes. Session cookies are encrypted though, that should make it more secure. If you're interested, you can read more here. It's a well-kown open source framework, I hope they have a reason for doing this way
Dec
18
comment Did I understand the website “autologin” feature right?
@YannisRizos as for your last sentence (of your previous comment), I know that; especially when dealing with CodeIgniter, which doesn't make use of native php sessions but instead uses regular cookies. So, summing up, regular session/cookies (in CodeIgniter's case) expire after x seconds, user can choose to have them last y seconds with my library's autologin, but he doesn't have to sign out. I think I got it. I think I gave to the "autologin" a too exoteric nature
Dec
18
comment Did I understand the website “autologin” feature right?
Ok, so what makes the autologin different from a regular session check? they're just two different methods, i.e. the session is expired but the cookie is not, so use the latter?
Dec
18
asked Did I understand the website “autologin” feature right?