Smartys wrote:Upon login a cookie is set with the proper details. That cookie is then used to authenticate the user on each page.
Right. That's the part I'm referring to then. The login is literally used to check and update the cookie. The cookie is then the roving authorisation, so to speak. However, if the cookie was to be trusted as is and used at all times, what's the point of the login timeout and re-login mechanism? The cookie could easily be updated without it. So why, if that's the case, should the cookie be trusted/used as an auth mechanism, (when the user hasn't logged in for a period of time), to authenticate their entitlement and access to the feed categories/forums? Normally, if the user has timed out, they need to login again to update the cookie as required, and the details are again checked against the db? However, if it was used as the auth key against the feeds, one part of the system is being removed, i.e: the login process. By virtue, that also removes one layer of security.
Btw, this all does make perfect sense in my head, but I've a feeling it's different when it's posted. If I'm still confusing everyone now, I'll concede the point.