On successful login on any social media
platforms, the unique member id from the member database is stored
in a session. Then, the cookies
are set to keep the login name and the password
for a specified expiration period. Instead of storing the users'
plain password, random password and token are generated and stored
in the cookie to avoid hacking.
Let's understand the steps for the process of loggin in with the
help of a PHP user authorization.
- User submits login form. Form sends login and password to
PHP.
- PHP validates login data, generates random string (session id),
saves it to closed server storage in pair with user login, and
sends session id to browser in response as cookie. Browser stores
cookie.
- User visits any page on this domain and browser sends a cookie
to server for each request.
- PHP checks if cookie has been sent, if such cookie exists in
server storage with pair with login. Identifies user, provides
access to his private content.
- Logout button removes the cookie from browser and sid-login
pair from server storage. Browser does not send cookies, server
does not see it and does not see sid-login pair.
Thanks