I developed a PHP application that has a login requirement. This application is exclusive, so no new users can create accounts. Initially, I implemented sessions to identify users, but it caused issues on tablet devices as they would lose their sessions. It seems that energy-saving operations might be the cause.
As a solution, I decided to modify my application and introduce a random security token for authentication. The authentication process now goes as follows:
- Login
- Generate a random security token and save it on the system
- Redirect the browser to
- On the server side, check if the file containing the token exists - if yes, consider the user authenticated
Currently, everything works perfectly fine. However, I have concerns regarding security. While it's not an issue if the user sees the security token, I want to ensure that it's not possible to obtain the token via a GET request. I am utilizing SSL encryption.
I attempted to modify expiration times and cookie lifetimes, which worked correctly on regular computers. On tablets, it functions properly unless they go into standby mode (wherein the screen turns black). In such cases, the session expires rapidly.