Very simple authentification system

[snicker]

http://penso.info/auth_generator

Something that doesn't require db calls / server-side sessions...

I just don't quite understand how it works, why you can't edit the cookie and fake somebody else

[AlienDev]

You have to use a DB and sessions to do it. (sessions are NEEDED but 99% of the time are easier)

If only the user id and a string of random characters are stored in the session then that can be compared to the db to check the user is really the right person. if the random characters in the session dont match the random characters in the DB then they are trying to spoof someone else.