What should be the correct authorization?

Question

PHP

Will it be considered an error if I authorize a user by his id. For example, there is a form with fields for login and password, I compare them with those in the database and if they match, then I write to the session $_SESSION['auth']='1';
And then I check like this:

if ($_SESSION['auth'] == '1') {
echo 'Вход';
}
else {
echo 'Выход';
}

Is this correct from a security point of view? How to do it differently?

Answer 1

the main thing is not to store it in cookies, otherwise you can manually write auth=1 there and voila.
For example, you can save id and hash = password + salt, and then check, there are different options.
SESSIONS are stored on your side, so they are more or less secure