How would you implement FORM based authentication without a backing database? | I have a PHP script that runs as a CGI program and the HTTP `Authenticate` header gets eaten and spit out. So I would like to implement some kind of FORM based authentication. As an added constraint, there is no database so no session data can be stored.


I am very open to having a master username and password. I just need to protect the application from an intruder who doesn't know these credentials.


So how would you implement this?


Cookies?


I could present the form and if it validates, I can send back a cookie that is a hash of the IP address come secret code. Then I can prevent pages from rendering unless the thing decrypts correctly. But I have no idea how to implement that in PHP.