I am trying to find a reliable source for cookie management. I read though OWASP so i roughly know what can be dangerous.
But I need to authenticate my users with cookies. Is there a complete step by step guide?
What I did:
generate a random and unique string.
associate the random string with a user in my cache rndstring -> user
create a secure and signed cookie. value= hash(rndstring+secret)|rndstring
if the user comes back, I check if the hashes matches, and if the rndstring is in my cache.
- if yes get the user.
I think my approach is flawed because I made it by myself. What resources can you recommend me?
