CODEWITHSUNDEEP
sessionserver
starkshang
starkshang

Reputation: 8538

What will be returned to identify user by server if username can be same?

I'm new to server developing,and there is a question:

when user logins,what will be returned by server to identify the user so that when user next logins they needn't to input username and password again,and what will be saved in server to record state of users,saved in memory or database.And will the solution will be different among mobile app and website?

I'm confused about this,anyone can teach me,thanks!

Upvotes: 0

Views: 69

Answers (3)

SimoV8
SimoV8

Reputation: 1402

There exist many authentication mechanisms with different properties to authenticate a client to a server.

The easiest one is with Sessions and I suggest you to start with it. The basic idea is that when a user succesfully login, the server generates a big unique random number (usually with an expiration time) and send it back to the user. Both client and server store this value somewhere. Next time the user performs a request, it sends back the session id and in this way the server knows it is the user that previously logged in. This mechanism is supported in almost every language and you can handle it very easily.

Another interesting authentication mechanism is called JWT (Json Web Token). In this case the server generates a self-contained token that user uses for future requests. In this case the server doesn't have to store the token because the needed information is embedded in the token itself. You can find all the necessary information and resources here: https://jwt.io/ .

There are also other standards to perform authentication that are slightly more complicated. One of the most popular is OAuth (https://en.wikipedia.org/wiki/OAuth).

Upvotes: 1

Zagonine
Zagonine

Reputation: 2313

You have to use session storage. An example, in common page : 

<?php

session_start();

if(!isset($_SESSION)) {
    //Redirection to login page
    header('Location: loginPage.php');
} else {
    //User is log
    var_dump($_SESSION);
}

And in login page :

<?php

session_start();

//Your query for verifing is username and password matched
$isMatched = true;

if($isMatched) {

    $_SESSION['userId'] = 45687; //Id of the user
    //You can save what you want in this session
}

And on every page you can retrieve the data save with $_SESSION['theValueYouSet']

Upvotes: 0

Eng.Fouad
Eng.Fouad

Reputation: 117597

When user sends his username/password, generate a session token. Then, store that token at the client side (as a cookie if using a browser for example). On the server side, you can save it in presistent store (database) if you need to keep it for long time, or in memory (user session).

Afterwards, the user needs to send that token to identify himself instead of re-sending his username/password each time. The session token can be sent in several ways; through cookies, Authorization header, post body, etc.

Also, consider sending the session token through a secure connection (https) for security concern, and check for session expiry as well.

Upvotes: 0

Related Questions