Are there any potential security risks associated with storing permanent passwords (as md5) and user IDs in cookies in PHP?

Storing permanent passwords (even as md5) and user IDs in cookies in PHP poses a significant security risk as cookies are easily accessible and can be tampered with by malicious users. To mitigate this risk, it is recommended to store a randomly generated session token in the cookie instead of sensitive information like passwords or user IDs. 

// Generate a random session token
$session_token = bin2hex(random_bytes(16));

// Store the session token in the cookie
setcookie('session_token', $session_token, time() + (86400 * 30), '/');

// Use the session token to identify the user instead of storing sensitive information
$_SESSION['user_id'] = $user_id;

Keywords

security risks storing passwords md5 user IDs cookies

Related Questions