I'm at the point where I need to implement login capability on my main page.
What method do you use? php with a database? cgi against a protected file? Clickpass.com like HN.
Or did you roll your own?
Ask HN: Which login method do you use?
1–10 of 58 posts
Re: Ask HN: Which login method do you use?
#2django.contrib.auth
Re: Ask HN: Which login method do you use?
#3I have always created my own. Although I've been doing PHP, I'm currently using RoR and it has a plugin that handles all of this. PHP with a database is very easy, especially if you use CodeIgniter, there are form validation helper classes.
On registration:
- Ask for username and password (do form validation, ie passwords match, xss clean, etc). toLowercase() the login.
- Create a hash of some type for the password. This becomes used in the database, and again on login. If you're not worried about security, md5 your password, store it in the db. Otherwise, look up a salt hash.
- I typically log the user out and then require them to log in and create a session after they registered.
On login
- Ask for username and password, toLowercase() the login when checking
- Run the same md5 or salt hash against the password, check if the # of rows in the database is > 0, if it is, log the person in and give them a session with a value of "is_logged_in" to true or something similar. Also pull the database user_id or e-mail and use that to remember which user you're dealing with.
- If the # of rows found in database is == 0 (where the login and pass equal those from your post variables), the login failed
Re: Ask HN: Which login method do you use?
#4I have my own code I use on my projects. It uses secure SHA 256 hashing for the passwords. The code handles registration, login, logout, and forgot password flows.
Re: Ask HN: Which login method do you use?
#5I have my own code I use on my projects. It uses secure SHA 256 hashing for the passwords. The code handles registration, login, logout, and forgot password flows.
We pass the login and passwords to an openldap server running internally, and then get back the success/fail message.
This is the best strategy for us because it allows us to offer a wide array of services running through our accounts, using out of the box software..
We can tie the forums into LDAP without writing our own, as well as our internal Jabber server, etc.
Once login has completed, we give the user a 128-bit sessionID, which we use for all further communication, until their session expires.
Re: Ask HN: Which login method do you use?
#6We used a combination of Cake Auth
Re: Ask HN: Which login method do you use?
#7I have always created my own. Although I've been doing PHP, I'm currently using RoR and it has a plugin that handles all of this. PHP with a database is very easy, especially if you use CodeIgniter, there are form validation helper classes. On registration: - Ask for username and password (do form validation, ie passwords match, xss clean, etc). toLowercase() the login. - Create a hash of some type for the password.…
Please don't just use MD5 or SHA1 with a salt.
http://www.matasano.com/log/958/enough-with-the-rainbow-tabl...
Re: Ask HN: Which login method do you use?
#8I am working rolling my own with Struts/JSP.
It seems pretty straightforward (hash pass, place on server, and check against), but I need an easy way to compute an SHA hash in-browser, so the server doesn't have to receive the pass in plaintext.
Anyone know of a way to do it with Struts/JSP, or even JS if its not too slow?
Re: Ask HN: Which login method do you use?
#9OpenID, if applicable.
Re: Ask HN: Which login method do you use?
#10Most every web application my team assesses just uses a database of hashes. This is fine; just try to make the hash function take a long time to run (speed is the enemy here). I highly recommend "bcrypt", a routine available in almost every dev environment --- and typically in the better plugins --- for generating safe auth hashes.