Member Avatar for riahc3

Hey

I want to make a website lets say http://www.mysite.com but before they view it, they have to login with username and password (those are stored in a DB). It doesnt matter if they access or ect the first time they access, they have to login, else they cannot view any content at all.

Once they are logged in, Im thinking of 2 alternatives (depends on which is more easy to implement and when has better security)

1: Once they log in, in a DB the date/time they login is stored. If in say 5 minutes, they dont do anything on the site, they have to input again their username and pass. If they do, the NEW date/time is stored and sofore.
2: A simple cookie that expires in a hour (or whatever time)

Thank you

  • 4 Contributors
  • 4 Replies
  • 416 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by Dragennd

Dani AI

Generated

Short answer: enforce authentication on the server for every request and use secure, server-side session state rather than trusting client-side cookies or ad‑hoc cache entries. Make every request run a single auth check (front controller, middleware, or PHP’s auto_prepend_file) so any URL — /, /hello, /hello/something/j.php — is blocked until the user is validated. Always use HTTPS and set secure cookie flags.

Prefer a server-side session + sliding inactivity timeout, with an optional separate “remember me” token if you need persistent logins. Keep session state (user id, last_activity, privileges) on the server (file/DB/Redis) and update last_activity per request; use an absolute max lifetime too. For a persistent login, issue a short-lived, random token pair (selector + validator), store only a hashed validator in the DB, and rotate it on each use — do not store passwords or plain user IDs in cookies.

A small practical pattern to include on every request (put this in an include that runs first):

<?php
// auth_init.php — include before page output
session_start();

// inactivity timeout in seconds
$inactive = 900; // 15 minutes
if (isset($_SESSION['LAST_ACTIVITY']) && (time() - $_SESSION['LAST_ACTIVITY'] > $inactive)) {
    session_unset();
    session_destroy();
    header('Location: /login.php');
    exit;
}
$_SESSION['LAST_ACTIVITY'] = time();

// Note: call session_regenerate_id(true) immediately after successful login.
?>

Notes and cautions: regenerate the session ID after login to prevent fixation, set cookies with HttpOnly, Secure and SameSite, hash passwords with a modern algorithm (bcrypt/argon2 via password_hash), rate‑limit/login lockouts, protect forms with CSRF tokens, and place protected static files behind server rules or serve them through an authenticated script (X-Sendfile/X-Accel-Redirect). As hinted, server-side checks are the right starting point; ’s cache idea points toward central stores like Redis (OK for sessions but beware eviction); ’s server password protection is the simplest but less flexible for full web apps. Store login timestamps in the DB for auditing, but don’t rely on them alone to control live sessions.

Recommended Answers

All 4 Replies

Member Avatar for Octet

The simplest way would be to use a PHP SESSION variable, it also means you don't need to get involved with the new data protection laws (which cookies fall under).

You would want to querry your login SESSION like this:

<?php

    if(!isset($_SESSION['LoggedIn']))
    {
        die (Header('Location: Login.php'));
    }

    else
    {
        echo "Welcome!";
    }

?>

That would simply check if the session has been set and if not then send them to a login page (to which you would set your session).

Then to update the DB, simply in the login bit include a mysql_query which updates the Login Time to the current date and time.

I hope that is useful? Sorry for not being able to provide much more information.

Member Avatar for lps

In my opinion, instead of establishing db connection, why don't you try to use cache to set the time. What I mean is use php to establish a cache which will expire in a certain time. Then, use the login function to assign the cache data. If the data is not exist, display the login form.

Member Avatar for riahc3

instead

In my opinion, instead of establishing db connection, why don't you try to use cache to set the time. What I mean is use php to establish a cache which will expire in a certain time. Then, use the login function to assign the cache data. If the data is not exist, display the login form.

And I do this how?

Member Avatar for Dragennd

I'm not all that proficient in php so I can't help much with Ips's reply, however, what you could also do is simply password protect your server. You can make it so that it requires a password to access anything within a certain directory. Most webservers allow for password protection and this is a simple way to block access to information on your website.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.