Cookie ("uid", the problem with the user's uid); login mechanism

the login mechanism I designed is
cookie ("uid", the user"s uid);
), and then check whether cookie ("uid") exists

.

I would like to ask why some customers open the website automatically login status, automatically log in to one person"s account
, and may log in to another person"s

every time they refresh.
Jul.26,2021

how is your uid generated? What does it mean exactly? What is your user data model? If it's a user's id, then I don't just change my love on the browser and become whoever I like. Login usually records a randomly assigned session ID sessionID in cookie, and then the server records the login status to the corresponding session. This sessionID if you are not random enough, you will conflict and log on to someone else's account


.

there is a problem with your uid generation.

in addition, do not judge the user's identity in such a simple way, cookie can be changed at will on the client side.


suggest that the database create a new token table, store the user id user ip token, and then store the token. on the web page. Verify ip and user id through token to determine whether he is logged in (). Tokene, which can add an expiration time as needed, can be encrypted with some of the user's information md5 or an other x some way. Refresh occurs when other users feel that multiple users may share a uid (such as a user database uid='')?

Menu