Come in! Authentication without login and password, v2

Once it turned out that the audience was not indifferent to such a topic as the creation of one-time (working for some time) links to identify the user.

And especially in the light of what I consider such a solution (which I will publish below) is more acceptable - I decided to write how I see the solution to this problem:

Everything is stored in the database. Mysql only because it is now at hand. For the postgame, oracle and sql server solution will be 99% similar.

Storage table:
')

Copy Source | Copy HTML CREATE TABLE test.one_time_auth( token CHAR (32), user_id INT (11) UNSIGNED NOT NULL , expire DATETIME DEFAULT NULL , PRIMARY KEY (token) ) ENGINE = INNODB

1. Copy Source | Copy HTML CREATE TABLE test.one_time_auth( token CHAR (32), user_id INT (11) UNSIGNED NOT NULL , expire DATETIME DEFAULT NULL , PRIMARY KEY (token) ) ENGINE = INNODB
2. Copy Source | Copy HTML CREATE TABLE test.one_time_auth( token CHAR (32), user_id INT (11) UNSIGNED NOT NULL , expire DATETIME DEFAULT NULL , PRIMARY KEY (token) ) ENGINE = INNODB
3. Copy Source | Copy HTML CREATE TABLE test.one_time_auth( token CHAR (32), user_id INT (11) UNSIGNED NOT NULL , expire DATETIME DEFAULT NULL , PRIMARY KEY (token) ) ENGINE = INNODB
4. Copy Source | Copy HTML CREATE TABLE test.one_time_auth( token CHAR (32), user_id INT (11) UNSIGNED NOT NULL , expire DATETIME DEFAULT NULL , PRIMARY KEY (token) ) ENGINE = INNODB
5. Copy Source | Copy HTML CREATE TABLE test.one_time_auth( token CHAR (32), user_id INT (11) UNSIGNED NOT NULL , expire DATETIME DEFAULT NULL , PRIMARY KEY (token) ) ENGINE = INNODB
6. Copy Source | Copy HTML CREATE TABLE test.one_time_auth( token CHAR (32), user_id INT (11) UNSIGNED NOT NULL , expire DATETIME DEFAULT NULL , PRIMARY KEY (token) ) ENGINE = INNODB
7. Copy Source | Copy HTML CREATE TABLE test.one_time_auth( token CHAR (32), user_id INT (11) UNSIGNED NOT NULL , expire DATETIME DEFAULT NULL , PRIMARY KEY (token) ) ENGINE = INNODB

Well, now the class itself + an example of working with it. In the example, we first create a token for the period until December 31 of this year, and then we get it.

Copy Source | Copy HTML

1. <? php
3. $ db = new PDO ( 'mysql: host = 127.0.0.1; dbname = test' , 'root' );
4. $ db -> setAttribute ( PDO :: ATTR_ERRMODE, PDO :: ERRMODE_EXCEPTION);
6. $ auth = new one_time_auth ( $ db );
7. $ token = $ auth -> remember ( 10 , '2010-12-31' );
9. $ user_id = $ auth -> remind ( $ token );
10. echo $ user_id ;
12. class one_time_auth
13. {
14. / ** <br/> * @var PDO <br/> * /
15. private $ db ;
17. public function __construct ( PDO $ db )
18. {
19. $ this -> db = $ db ;
20. }
22. public function remember ( $ user_id , $ expire = null )
23. {
24. $ sql = 'INSERT INTO one_time_auth (token, user_id, expire) VALUES (: token,: user_id,: expire)' ;
26. $ stmt = $ this -> db-> prepare ( $ sql );
28. while ( true ) {
29. try {
30. $ stmt -> execute ( array (
31. ': token' => $ token = $ this -> generateToken (),
32. 'user_id' => $ user_id ,
33. 'expire' => $ expire
34. ))
35. break ;
36. } catch ( PDOException $ e ) {}
37. }
39. return $ token ;
40. }
42. public function remind ( $ token )
43. {
44. $ sql = 'SELECT user_id <br/> FROM one_time_auth <br/> WHERE token =: token <br/> AND (expire IS NULL OR expire <= NOW ()) LIMIT 1' ;
46. $ stmt = $ this -> db-> prepare ( $ sql );
48. $ stmt -> execute ( array ( 'token' => $ token ));
50. if ( $ row = $ stmt -> fetch ()) {
51. $ stmt = $ this -> db-> prepare ( 'DELETE FROM one_time_auth WHERE token =: token' );
52. $ stmt -> execute ( array ( 'token' => $ token ));
54. return $ row [ 'user_id' ];
55. }
56. }
58. private function generateToken ()
59. {
60. return md5 (uniqid ( '' , true ));
61. }
62. }

PS: the code was written "on the knee" simply as a response to the topic habrahabr.ru/blogs/php/109421

PPS: I would immediately like to clarify about md5 () - this function in this context does not add any “holes”, this is just a way to get a hash. If desired, you can replace with sha1 (), or any other at will. The main idea is that you do not need to be tied to user data.