經過客戶端的cookie標誌來設置用戶是否登陸了安全嗎？經常使用的加密算法加密後安全嗎？

一、經過在客戶端cookie 設置是否登陸標誌，有可能會有安全隱患，當hack把cookie值修改後，可能就能夠登陸。

You could use this strategy described here as best practice (2006) or an updated strategy described here (2015):

1. When the user successfully logs in with Remember Me checked, a login cookie is issued in addition to the standard session management cookie.
2. The login cookie contains a series identifier and a token. The series and token are unguessable random numbers from a suitably large space. Both are stored together in a database table, the token is hashed (sha256 is fine).
3. When a non-logged-in user visits the site and presents a login cookie, the series identifier is looked up in the database.
   1. If the series identifier is present and the hash of the token matches the hash for that series identifier, the user is considered authenticated. A new token is generated, a new hash for the token is stored over the old record, and a new login cookie is issued to the user (it's okay to re-use the series identifier).
   2. If the series is present but the token does not match, a theft is assumed. The user receives a strongly worded warning and all of the user's remembered sessions are deleted.
   3. If the username and series are not present, the login cookie is ignored.

This approach provides defense-in-depth. If someone manages to leak the database table, it does not give an attacker an open door for impersonating users.

二、經常使用的加密算法並不安全

能夠反向MD5 ，給出MD5或者其它經常使用加密算法的密文，經過查庫，能夠得到原文。

http://cmd5.com/