Re: Authentication design

[Michael L. Artz]

Hmm, I see now.  I don't really care about users who aren't logged in, 
so I don't know that there is a need to store session data for them.

I guess my pattern is:
within PerlAuthenHandler
-Check to see if there are passed user/password params.  If so, 
validate params against user/pass in database.  If the params are 
valid, create a new session key, store the session key in the 
database, and set a cookie with the user_id and session_key.
  


Isn't the session key unique?  Why put both in the cookie?

Because my session table is indexed off the user_id.  I know that it 
probably won't matter until I have something like 100+ 
nearly-simultaneous users, but I thought that it would be nice to plan 
ahead, just in case.

I guess what I am hearing is the good-ole Perl adage: tmtowtdi.  I think 
that what I have both works and seems to fit my needs just fine, so I 
will stick with it, just wanted to make sure that it wasn't glaringly 
horrible for some reason.  Thanks to all who chimed in.

-Mike