user authentication – (please point me in the right direction)

@StevishMar 18.2009 — #Just so you know, this is a HUGE can of worms to open. Security is probably the hardest thing to keep track of because it's never 100% secure (just like anything in life). I read one place that having good security is not about preventing every attack, but about slowing down the attacker enough that you can stop them before they get any valuable information and/or quickly fix whatever they screw up.

You may have to google around for the different types of things you want to do, but here's a list of things you'll probably need to implement:

[LIST]

[*]A secure password hashing system (using at least 2 salts... one static, and one that's unique for each user. This hashing process should be unique to your site)

[*]Database isolation (ie. the db user that is called by the login script should only have SELECT priveledges on the login database)

[*]Session Hijacking countermeasures (checking the IP address, browser info... etc)

[*]Encryption of sensitive information in the database

[/LIST]

That's not an exhaustive list of course, but it's all I can come up with right now. As for your question about storing the user access level in the session, My login script is set up to do that, although I could never get a straight answer about how secure that is. But as far as I know about session variables, only the PHP script can change the values in them, so it's just a matter of making sure all user input is validated properly so they cannot inject anything into the code that would get written to the session variable.

user authentication – (please point me in the right direction)

2 Comments(s) _↴

Also in #PHP _↴

Success!

Social

Version

user authentication – (please point me in the right direction)

2 Comments(s) ↴

Also in #PHP ↴

Success!

The web is an endless sea of information. Don't miss the boat... Subscribe!

Social

Version

2 Comments(s) _↴

Also in #PHP _↴