Hardening Sessions and Authentication

Common legacy problems: session IDs not regenerated at login, cookies missing Secure/HttpOnly/SameSite, 'remember me' cookies containing user IDs or md5 hashes, and no rate limiting on login. Fix with secure session settings, session_regenerate_id(true) on login, random remember-me tokens stored hashed (selector/validator pattern), and throttling.

<?php
// Remember-me: selector/validator pattern
$selector = bin2hex(random_bytes(9));
$validator = random_bytes(33);
$pdo->prepare('INSERT INTO auth_tokens (selector, hashed_validator, user_id, expires_at) VALUES (?, ?, ?, ?)')
    ->execute([$selector, hash('sha256', $validator), $userId, date('Y-m-d H:i:s', time() + 30 * 86400)]);
setcookie('remember', $selector . ':' . bin2hex($validator), [
    'expires' => time() + 30 * 86400, 'path' => '/', 'secure' => true, 'httponly' => true, 'samesite' => 'Lax',
]);
// On use: look up by selector, compare hash('sha256', validator) with hash_equals, rotate token.

Common pitfalls

• Remember-me cookies with predictable values (user ID, md5 of email).
• Storing tokens unhashed in the database.
• No way to revoke all sessions after a password change.

Key points

• Regenerate session IDs at login
• Random, hashed remember-me tokens
• Throttle logins; revoke on password change

Further reading: Paragon IE: secure 'remember me'