check password in all restrict pages or just in login?

Question

I have a user session in my website. In login page I do:

//mysqli select

if (password_verify($password, $hash)) {
    $_SESSION["user"] = $user;
}

so every page I just check: if(!isset($_SESSION["user"])){die();}

my friend told me that I should record in a session, on login, the password too, like this:

if (password_verify($password, $hash)) {
    $_SESSION["user"] = $user;
    $_SESSION["pass"] = $pass; //$pass that user type in login
}

and in each page do a select in mysql again with session user and pass do check if login is valid or not.

So my question is, do I need to check password in mysql each page or can I do it just once in login?

may be its effects on ur performance after query on every page ... i dont think u need to add query on each page ...once query run then why again ,indirectly u do login again and again after adding query to each — Maninderpreet Singh, May 03 '16 at 11:00
The password is not needed. You are not gaining any security, but you lose a lot of performance. — colburton, May 03 '16 at 11:04

score 3 · Accepted Answer · answered May 03 '16 at 11:03

If you are using Session to login then there is no need to verify the password in all the pages as Session variables are only editable by your program, on the other hand if you were using Cookies to save user and password then you might need to check on all pages as users can change Cookies.

But if you use Session variables and incase you delete the user from your Admin Panel or Lock his account access, and if user was logged in before he will have continued access. So you must also put some check that whether the Username and Password saved in the session is still valid or not.

score 3 · Answer 2 · edited May 03 '16 at 11:28

3

It does not make any sense.

You get Password from Login form
You check it's correct or not
If correct you allow for other pages

Now, if you store same password in session at the time of login, You will get Passwords match at every page because passwords is in Session and will be same till session will get expire, and on session expire user should go to login page only.

This may affect performance.

edited May 03 '16 at 11:28

Vipul Jethva

647
1
7
27

answered May 03 '16 at 11:04

AkshayP

2,141
2
18
27

thank you for your answer! so hackers can't add an $_SESSION["user"], like, add "admin" to $_SESSION["user"]? – RGS May 03 '16 at 11:07
1

Please refer : http://stackoverflow.com/questions/3798532/can-session-value-be-hacked – AkshayP May 03 '16 at 11:09

check password in all restrict pages or just in login?

2 Answers2