Fix admin login: replace PHP sessions with HMAC cookie auth

mirror of https://github.com/myronblair/parkerslingshotrentals synced 2026-07-28 00:52:54 -05:00

PHP sessions were unreliable on this host — the web process could write
session files but LiteSpeed served cached login-page responses on the
redirect, bypassing PHP entirely.

Replace sessions with a self-contained signed cookie:
- On login: generate random 32-byte token + expiry, sign with HMAC-SHA256
- On each request: verify signature and expiry — no filesystem reads needed
- Cookie: Secure, HttpOnly, SameSite=Lax, path=/admin/, 24h expiry
- admin/.htaccess: CacheEnable off + no-store headers to prevent LiteSpeed
  from caching admin responses

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

This commit is contained in:

Myron Blair

2026-05-22 14:15:33 +00:00

parent b3b831e4a0

commit 8f5362aa95

2 changed files with 43 additions and 9 deletions

									
										admin/.htaccess
									
		+5
		
												View File
												
				@@ -0,0 +1,5 @@

				<IfModule LiteSpeed>

				CacheEnable off

				</IfModule>

				Header always set Cache-Control "no-store, no-cache, must-revalidate"

				Header always set Pragma "no-cache"