title: PHP session var enough for user auth?
body: <p>Scenario:</p>
  
  <ul>
  <li>After a user has logged in, a session variable is set confirming their login.</li>
  <li>At the top of every page, login session variable is confirmed valid</li>
  <li>If it's not, they're booted out.</li>
  <li>No persistent cookies are used, only <code>session</code></li>
  </ul>
  
  <p>Question:</p>
  
  <p>Is this a strong enough security measure by itself, or should I</p>
  
  <ul>
  <li>Set two session variables to validate eachother and/or</li>
  <li>Implement database/hash validation</li>
  <li>...?</li>
  </ul>
  
  <p>========</p>
  
  <p>(Incidentally, while I was researching this question, <a href="https://stackoverflow.com/questions/549/the-definitive-guide-to-website-authentication#477585">this wiki</a> is a fantastic read.)</p>