title: CodeIgniter session help, cookies not secure?
body: <p>I'm just getting into learning about sessions, and for my purposes, I want to create something that upon every request from the client, the server authenticates that user, and only then performs data-handling for that user.</p>
  
  <p>However, I have seen a lot of examples with CodeIgniter where the session is set up as thus:</p>
  
  <pre><code>$this-&gt;load-&gt;library('session');
  
  $newdata = array(
                 'username'  =&gt; 'johndoe',
                 'email'     =&gt; 'johndoe@some-site.com',
                 'logged_in' =&gt; TRUE
             );
  
  $this-&gt;session-&gt;set_userdata($newdata);
  </code></pre>
  
  <p>However, couldn't someone just create a cookie on their computer with a common username and the 'logged_in' state to true, and suddenly you're authenticated without a password?  This seems like a security flaw to me, but I see so many examples like this.</p>
  
  <p>What is the proper way to authenticate the user on each request?</p>