title: Developing a secure PHP login and authentication strategy
body: <p>I'm developing a login and authentication system for a new PHP site and have been reading up on the various attacks and vulnerabilities. However, it's a bit confusing, so I want to check that my approach makes sense.</p>
  
  <p>I plan on storing the following data:</p>
  
  <ul>
  <li><p><strong>In the session:</strong> user-id, hashed + salted <code>HTTP_USER_AGENT</code></p></li>
  <li><p><strong>In the cookie and in the database:</strong> random token, hashed + salted identifier</p></li>
  </ul>
  
  <p>On every page, I plan on doing the following:</p>
  
  <ol>
  <li><p><strong>If a session exists, authenticate using that.</strong> Check that the <code>HTTP_USER_AGENT</code> matches the one in the stored session.</p></li>
  <li><p><strong>If no session exists, use the cookie to authenticate.</strong> Check that the token and identifier in the cookie match those in the database.</p></li>
  <li><p><strong>If the cookie is invalid or doesn't exist, ask user to login.</strong></p></li>
  </ol>
  
  <p>Are there any obvious flaws in this? As long as I set a timeout in the cookie, I should be fairly safe, right? Is there anything I'm missing?</p>
  
  <p>Many thanks in advance.</p>