
April 21st, 2004, 10:38 PM
|
|
Registered User
|
|
Join Date: Apr 2004
Posts: 2
Time spent in forums: < 1 sec
Reputation Power: 0
|
|
|
frame drama and cookie/mysql security
i'm in the process of building a website and i have some design and security questions.
the current setup is as follows: registered users that are in a MySQL database may login and are given md5-hashed cookies to keep track of the login, and the design uses frames (a nav frame, title frame and large central frame)
1) elusive frame refreshing: i want, after each user has logged-in, to change the "login" button in the nav frame to read "logout", but i don't know how to make a given frame just refresh (then i could embed some PHP to make the button change); i DO know how to have a link that will load in a given frame (supply a target="mainFrame" in the HTML), but not how to do what i just described above
2) are frames even a good idea, or are they more trouble than they're worth? should i just write a big PHP file that generates dynamic HTML and then reloads itself with form values based on people clicking, logging-in, etc.? i don't know much about the standard procedure that others follow, so any info here is appreciated.
3) all user information (just login and password for now) is stored in md5-hashed form in a MySQL database and the supplied login info is md5-hashed and checked against the database; once this is done, a cookie containing the md5-hashed login and password is set for X seconds (3200 for now) and upon logout, the cookie is unset by expiring it (subtract from the time left valid); an initial concern is that someone could sniff the cookie and use the login until the cookie expires, but this isn't a huge concern (should it be?); are there any serious security problems with this model? since the info is md5-hashed into the database, brute-forcing shouldn't be a huge issue, should it?
any suggestions or pointers to relevant info would be appreciated.
thx for reading
|