How can I simplify user authorization as much as possible?

Question

I am developing a small website where I am going to allow the user to create accounts, but I have absolutely no idea when it comes to security when logging in.

I built my PHP project using codeigniter and found a library ( Tank Auth ) that could handle authorization for me. It stores the password securely, but I'm still worried about the part when the user sends their password to my server.

One easy way to do this is to send the password in a post request, but I would suggest that it is fairly easy to sniff such a password. Do I have to do something with the password on the client side before sending it to my server? And are there any good javascript libraries for this?

Answer 1

According to others, SSL is the preferred migration method.

David Watter measured hashing - there’s a detailed discussion of the process here

An alternative approach is to rely solely on external providers to process your authentication for you - openid , which is the most obvious candidate.

NTN

WITH.

Answer 2

You can spoof with hashing on the client side, but authentication over a secure connection (HTTPS) is generally considered sufficient.

MITM... MITM SSL- , , , , .

Answer 3

, SSL , . IP- .

, , , , . , MITM ; , , .

() - , .

Answer 4

SSL, , .

If you encrypt it with something like rot13, etc., it will easily cancel.

As already mentioned, you would like to make sure that the security of your site is not dependent on Javascript, as this can be easily disabled.

Any other operations performed on the client side can be easily violated.