Authorization on the site! How is it better?

Question

PHP

Hi all!
I have a user registration / authorization on the site! I use password_hash during registration, during authorization I check password_verify, then I write the user's login and password to the session, and on each page I just check if there are session variables login and password, then I open access to ...
Everything works fine, but it seems to me that this is somehow not right, just check for the existence of session variables, you can probably do some more "complicated / secure" user identification on each page, I thought just pulling the password hash from the database and do a password check on each page - password_verify, but I think there will be no load on the server, with a large visit to the site (I hope in the future!)))). Maybe someone knows how best to identify the user at each transition from page to page?
That's probably it! I think the question was clearly explained, tell me who is in the subject! Thanks ))

Answer 1

Imho standard solution:
When authorizing a user by login-password, we generate some long string (token), write it to the database, + write it to cookies.
With each user request, we take this token from the cookie and check if there is one.
If desired, you can tighten the lifetime, check ip, etc., etc.

Answer 2

habrahabr.ru/company/aktiv-company/blog/185248