Comments on: Logging in users via Zend_Auth without Sessions in PHP / Zend Framework

By: Roland Deschain

Roland Deschain — Sun, 19 Sep 2010 16:12:59 +0000

it's sort of deadpost, but i just found this code and it is very useful, Thanks!
I just want to suggest, that line 167 should look like :
$this->_cached = base64_decode($contents);
so you can read string insteand of coded string using Zend_Auth::getInstance()->getIdentity
Cheers

By: marcus

marcus — Wed, 06 May 2009 00:06:13 +0000

Thanks for pointing that out, Cliff, I appreciate it. I've updated the code.

As one might imagine, the base64 encoding was an untested last-minute change that I am not using in my production code because of the overhead.

Keeping the identity (say, just a username) in clear text also allows for some neat features, such as the ability to read it out via Javascript and update otherwise static HTML with a seemingly dynamic header. I'll save that for another post.

By: Cliff

Cliff — Tue, 28 Apr 2009 12:31:03 +0000

Just a heads up.

In line 189 (writing the cookie): you base64_encode() the $contents _after_ you've created the MD5 hash.

In line 166 (reading the cookie): you don't base64_decode() the $contents before performing the MD5 to compare against the checksum held in the cookie.

Line 166-167 should be:
if (md5(base64_decode($contents) . $now . $this->_secret) == $checksum) {
$this->_cached = $contents;
}

~ Cliff