{"id":1489,"date":"2018-01-19T19:22:54","date_gmt":"2018-01-19T19:22:54","guid":{"rendered":"http:\/\/goofy-trucks.flywheelsites.com\/complete-secure-user-auth-library\/"},"modified":"2018-01-19T19:24:49","modified_gmt":"2018-01-19T19:24:49","slug":"complete-secure-user-auth-library","status":"publish","type":"post","link":"https:\/\/phpbuilder.com\/complete-secure-user-auth-library\/","title":{"rendered":"Complete, Secure User Auth Library"},"content":{"rendered":"
\n
\n
By Tim Perdue<\/div>\n
on July 30, 2000<\/div>\n<\/p><\/div>\n
\"picture<\/p>\n
\nWhen I started seeing spam messages posted to the new column annotation system, I knew
\nI would have to create some sort of user authentication system that helps weed out the losers.
\nI’m the type that would rather write an entire library myself than try to learn something like PHPLib
\nor other similar libraries.<\/div>\n
\nThe library needed to handle registration, confirmation emails, account updates (passwords, emails)
\namong other things. It also needed to be secure while not creating a burden on my overloaded database.<\/div>\n
\nSo the new system needed to rely on cookies while not being totally exploitable. It was an interesting
\ndilemma. I knew I couldn’t simply set a user_name cookie when they logged in (the user name cookie is
\neasy to spoof). I also knew I didn’t want to set a simple hash and have to confirm that hash against my
\ndatabase.<\/div>\n
\nThe solution was to set both. A user_name cookie is set, along with a hash. The hash is an md5() hash
\nof the user_name as well as a super-secret variable that only PHPBuilder knows. Since md5() is a one-way
\nhash and is, for all intents and purposes, going to secure practically any website, but should not
\nbe taken to be “uncrackable”*<\/strong>. I could safely create a hash of the email, which is
\na known variable, plus the secret variable. It’s kind of a public-key\/private-key kind of system.<\/div>\n
\nThe interesting thing about this system is that it could scale up almost infinitely. Since the hard work
\nof this system is done by md5() on the web server, additional servers can be dropped in incrementally to
\nhandle the load. The same is not true of an auth system that hammers a database – the database itself
\neventually becomes the bottleneck.<\/div>\n
\n* This is a correction requested by the author. Please see comments below for clarification.<\/small><\/div>\n<\/div>\n

<\/p>\n

\n
1<\/div>\n
| <\/div>\n
2<\/a> <\/div>\n
Next Page \u00bb<\/a><\/div>\n<\/div>\n

Download: tim20000505.php3<\/a>\n <\/div>\n","protected":false},"excerpt":{"rendered":"

By Tim Perdue on July 30, 2000 When I started seeing spam messages posted to the new column annotation system, I knew I would have to create some sort of user authentication system that helps weed out the losers. I’m the type that would rather write an entire library myself… <\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-1489","post","type-post","status-publish","format-standard","hentry","category-tutorials"],"_links":{"self":[{"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/posts\/1489","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/comments?post=1489"}],"version-history":[{"count":1,"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/posts\/1489\/revisions"}],"predecessor-version":[{"id":2252,"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/posts\/1489\/revisions\/2252"}],"wp:attachment":[{"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/media?parent=1489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/categories?post=1489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/phpbuilder.com\/wp-json\/wp\/v2\/tags?post=1489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}