title: shared sever cookie login security
body: <p>Apologies if this question has been asked before. I am having trouble finding an answer that explains things in a way I understand. </p>
  
  <p>I am using a shared linux sever to host a php/mysql site or two. I have coded a login for the admin area that uses sessions (the session data is stored in a database) but the problem is that the sessions timeout after 20 or so minutes. I have spoken to the hosting provider and as far as I can tell there is no way to change this. I have tried changing the gc_maxlifetime in htaccess and individual php.ini files (they either break the system or don't work). The hosting provider confirmed that my attempts were probably futile. </p>
  
  <p>So I have switched to using cookies as a test. However I am concerned that there is now a security issue. The cookies I store (username/shar encrypted password, user agent/remote_address, a token and some time related items) are all AES encrypted in the cookies, I also use some salts, IP checks and a lock down after a number of bad login attempts.</p>
  
  <p>The token is changed even login and is stored in the database to be compared that is really doing any protection, the rest of the items are just making sure the right data is being displayed for the user that is logged in. I am concerned that the token is the only real piece of protection I have. Given my constraints with the host I was hoping that I could get some suggestions/help or pointed to a piece of code that provides a better solution or at least adds to what I have done. </p>
  
  <p>Perhaps I have gone about it the wrong way entirely. Just to re-iterate as far as I can tell I can't seem to get sessions to stop timing out after 20 minutes :(. </p>
  
  <p>Thanks for any help in advance.</p>