Login and register via ajax is secure or not?

Question

My JS Code(Just example, maybe there is some syntax error)

$(document).on('click','#btnEdit',function(e){ 
    var id = $("#inp_id").val(), ps = $("#inp_ps");     
    $.ajax({
        type: 'POST',
        url: 'http://example.php',
        data: {act:'#LogIn',id:id,ps:ps},
        success: function(response){
            if($.trim(response) === "success"){
                alert("Login Successful");   
            }
            else{
                alert("Invalid ID or Password");
            }
        }
    });
});

Inside the php

if($_POST[act] == "#LogIn"){
    $userid = Encrypt($_POST[id],$key1);
    $userps = hashPS($_POST[ps],$salt);
    //query...
    if(result > 0){
         $_SESSION['id'] = Encrypt($userid,$key2);
         $_SESSION['token'] = //random code;
    }
}

My question:

Is there any way to make the code secure? Because i think the attackers can just write their own script and send data to the php for getting and id. Or maybe it is just a bad idea using ajax to login and register.

Answer 1

Check out The definitive guide to form-based website authentication [closed] .

---

Salting from frontend mainly aims at protecting privacy of your users. While CAPTCHA aims at verifying your user is a real person but a spider and protecting your server from DDOS attack.

To guarantee security you need HTTPS. There are potential risks if you implement login service without HTTPS, such as Man-in-the-Middle-Attack. So I have to provide a backend solution here.

As is mentioned by Raptor, attackers can still test the password via bruteforce. Yes, indeed. Yet if you choose your encryption algorithm correctly, it will take millions of years to crack a single password.

Besides there is one more attack, named Cross-site request forgery. You have to prevent it by simply introducing a csrf_token.

I asked a question(【django-1.11.3/angular-1.6.4】POST AJAX CSRF verification failed) a year ago where you might get some inspiration.

Certbot

Installation

sudo apt install certbot

Configuration

sudo certbot certonly --standalone -d example.com -d www.example.com

Not Certbot

It's sometimes better if you use OAuth and make service providers such as Google or Facebook take the responsibility to take care of login security.

Answer 2

The best practices for making it secure are as follows.

1. Implement CSRF token so every request is sent using a CSRF (Cross Site Request Forgery). CSRF insures if the request is valid. You may get further details about CSRF implementation from here

2. Apply IP check on the server side. Check from which IP the request is coming. You should only accept the requests which are coming from your own server. You can use $_SERVER['REMOTE_ADDR'] for that purpose

3. Captcha on the client side to protect from BOTS Google recaptcha is best for this. Details are here

If you apply the above you will be secure enough for POST requests.