Is there a way that I can initiate a persistent session in PHP without the placement of a session cookie? Are there other ways of maintaining a session across pages, such as an IP address-based solution?
My reason for asking is, is that although most users have cookies on, I want to see if there's a way for a login system to work for those with it disabled (even though I think disabling cookies is just unnecessary paranoia, personally).
If I wanted to do that then I would add the session id in the HTML code as a comment tag and use and configure the PHP code to use that session id which is included in the HTML code. I think it will be more relevant to do that instead of doing it with user IP or adding the session id in the URL.
The correct answer on this is NO. Using any combination of variables besides a cookie is insecure.
Think about it: when a user FIRST requests a page, the server is sending the page along with a unique value saying "HTTP is stateless, keep this so I know it's 'you' next time you call". That means, that person, in that browser (regardless of tab), running at that time, has a unique token.
If and only if they've logged in successfully, that token can now be tied to a session on the server side. Tokens are supposed to be so long and random that nobody could guess one in time.
Multiple browsers could be using the same IP address. Multiple people could have the EXACT same user agent. A cookie is the only storage system that works.
There's actually one more way, and that is to add the unique token to every single link back to the server as well as all AJAX calls, like ?PHPSESSID=my-unique-token-189481958 - but that's a pain to code.
You can also login without Cookies only by Session Id and Time, but you have to write them both in your Database direct after Successful Login.
I have in index.php something like this that will always generate a new session id based on time and the old session id if conditions are not verified.
if ($_SESSION['id'] != $row['session'] || time() > $row['sessiontime']) {
session_destroy();
session_start();
session_regenerate_id();
}
$_SESSION['id'] = session_id();
I use 2 variables in database for id and time.
And in login window I read the Session id from $_SESSION['id'] variable, then I increment the time and send both to database.