Are two database trips reasonable for a login system?
- by Randolph Potter
I am designing a login system for a project, and have an issue about it requiring two trips to the database when a user logs in.
User types in username and password
Database is polled and password hash is retrieved for comparative purposes (first trip)
Code tests hash against entered password (and salt), and if verified, resets the session ID
New session ID and username are sent back to the database to write a row to the login table, and generate a login ID for that session.
EDIT: I am using a random salt.
Does this design make sense? Am I missing something? Is my concern about two trips unfounded?
Comments and suggestions are welcome.