title: PHP Stateless Authentication
body: <p>I'm not new to PHP, but for authentication I've always used sessions. 
  Now I'd like to make stateless authentication, so I can't use sessions, because there might be many server instances, and they won't share session data, so what I thought is have a session table on my database, and do the following:</p>
  
  <ul>
  <li>Store a cookie with a token in the client's machine</li>
  <li>Have a <em>token</em> column in the session table, something like a GUID, so all entries with the same token can be accessed by the client</li>
  <li>Also store the ip of the client, so people with the same token but different IP can't read the data</li>
  </ul>
  
  <p>Something like this</p>
  
  <pre><code>id   | token        | ip         | key       | data
  1    | a-guid       | 190.0.0.1  | username  | encrypted-data
  2    | a-guid       | 190.0.0.1  | is_logged | more-encrypted-data 
  3    | other-guid   | 190.2.2.2  | is_logged | some-more-data
  </code></pre>
  
  <p>So the user with a cookie with token a-guid and ip 190.0.0.1 can access <em>username</em> and *is_logged* </p>
  
  <p>But I'm not sure about security, if someone could somehow get your token from your cookies, and your ip, and he/she could send a request with your cookie token and your ip, it would have complete access to your account.</p>
  
  <p>Should I have some special considerations?</p>