Secure web login example/tutorial [closed]

Question

There are lots of ways to create a login form for web apps and most of them are flawed one way or the other:

• Passwords are transmitted/saved as clear text
• The login dialogs are subject to XSS attacks or SQL injection

Is there an example or tutorial how to create a secure login form?

Answer 1

I agree with Carlos about lack of "perfect" secure system, not only for login, but for any other component. The only thing to do is to minimize risks by following best practices, but always keeping in mind that total safety doesn't exist, so your question is quite difficult to answer, although there are some good examples out there nothing is perfect, security is a very fast evolving topic.

For me the main things to solve are:

-Data transmission: The user is always going to type a password and this has to be sent to your system before it was processed, so there is a high risk of being intercepted if you are using an open channel. To solve this you MUST use transport the data over an encrypted channel (SSL), no other way unless you drop the common password (for example using one-time use tokens, or delegating the authentication to a third party, like Facebook connect or openId). See "How to Make a Secure Login Form with SSL"

-Input Sanitation: To avoid XSS and SQL Injection consider any input that comes from a client as a potentially risk point, therefore you have to perform validation against anything that comes form outside --> doc. Another good practice is never use the inputs directly on queries, use as bind variables in prepared statements or stored procedures.

-Password Storage: Password should always be stored encrypted with a one way hash algorithm, so even in the case of someone accessing your DB, there is no way to recover the original passwords. Also use techniques as Salting, Hashing multiple times, etc... Also be careful to choose an algorithm that is not weak or outdated (like MD5), which can be broken by brute force easily with the increasing CPU power.

-Infrastructure: Have your machines, OS, frameworks, libraries always updated to avoid bugs and 0 day attack. Any system today is enormously complex, and the system is as secure as it weakest component.

-Other Things to Consider: Review your security policy regularly to see if needs to update anything, implement password policies (expiration, reuse, etc...), log access, use monitoring tools for your systems, etc etc etc

And after all that, you can still be sure that if someone has enough time and resources, your system will fall.

Answer 2

Your question, can't be that agnostic, and must be divided in your two main concerns:

Transmitting passwords in the clear. Xss, Sql injection.

No system will be declared secured per se, but you can try your best to minimize the risks by using proven concepts.

So let's say you have the chance to design your own "secure system", what do you need?

At minimum you will need a basic set of tools:

Client side data encripting: (Javascript here, i think you will find lots of info of how to send your data in data 64 or something like that, remember you are searching for one way or two way encription)

DB Encription: (One way-two way encription, but never save passwords in the clear)

SQl injection: (mysql_real_escape_string() comes to mind).

Every language has some sort of protection built in, it is when building large projects that sometimes we may forget to sanitize some querys

I repeat no system will ever be declared secure, however you can add some other security measures as in:

• access_tokens = timed-strings that allow to validate user login.
• captcha_after_few_intents = you should add this definitely.
• block_account_after_few_trys = pain in the * for users, but definitely worth it.
• login_token = store a token unique for that user, and use it in all GET/POST transactions
• SSL

From Bank Security:

• Automatic gsm devices that generates RANDS and access_tokens valid only for a short time.
• mouse keyboard: evitates keyloggers
• random_access_question:
• check_random_account_country_change = let's say user is from albany and next day he logs in from south america, that should maybe raise a flag to your system.

I'm sure you will find plenty of advice somewhere, but remember you at end will end talking html, and some js, your main defense is on the server side, so be good, or be good at it.