Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am creating a login system and was wondering if anybody had any suggestions. Here is my current setup:

  1. nonce to check if the login originated from our login form
  2. session and cookie auth mixed - in a session cookie sha256(username-set-in-a-session,static-cookie-id,user-agent)
  3. The php session id is regenerated every request
  4. SSL on the whole site
  5. Check if they have been active - timeout after 1 hour
  6. Password must be 8 characters with at least a number and a letter
  7. Password stored with a static and dynamic salt with the hash sha256
  8. After 10 failed logins on any account show recaptcha
  9. After 10 failed logins on one account disable it for 10 minutes or until email confirm
  10. Generic error messages - ex: login failed, please try again
  11. SQL injection prevented
share|improve this question

3 Answers 3

up vote 4 down vote accepted

The best advice I can give you is to read the definitive guide to forms-based website authentication on StackOverflow. It's pretty much the best answer you'll ever need, and it includes plenty of links to further reading.

share|improve this answer

You might be duplicating effort and I see weaknesses with your approach to password selection and storage as well as a great way to apply a DoS attack to the admin accounts in your system. You might want to consider using this instead:

http://barebonescms.com/documentation/sso/

That is an enterprise-grade SSO system. It does everything your system does - only better and without the DoS issue.

Polynomial's response is actually pretty good but I doubt it will be the "best answer you'll ever need" - after all, security is a moving target. Today's best answer might be tomorrow's "ZOMG - I can't believe we used to do that!"

share|improve this answer
    
Where do you see the DoS attack? –  Ethan H Jun 18 '12 at 21:05

session and cookie auth mixed - in a session cookie sha256(username-set-in-a-session,static-cookie-id,user-agent)

With no salt, then that's easily reproducible - how does it help security?

The php session id is regenerated every request

While you should always regenerate a session id on transition between different authentication states, doing it for every request is rather silly. It's not helping security and is likely to break the site in strange ways (e.g. if user splits the session).

After 10 failed logins on one account disable it for 10 minutes or until email confirm

So not bothered about multiple consecutive failed logins from the same IP address / user agent as long as they are for different accounts?

SSL on the whole site

But have you checked you've got the secure and httponly flags on your cookies?

share|improve this answer
    
1. It is what we check to see if the user is logged in. The 'static-cookie-id' is different for every user - just static as in it doesn't change per request –  Ethan H Jun 18 '12 at 21:06
    
2. For the second one, that makes sense, I might change it to maybe every ten requests and when auth level changes –  Ethan H Jun 18 '12 at 21:07
    
3. For that one, I do not see any purpose for that as most experienced hackers will switch between ip addresses as soon as they are blocked. As for the user-agent that is easily changeable with either a browser addon or changing browsers. –  Ethan H Jun 18 '12 at 21:09
    
4. On all my cookies I do have secure and httponly flags set –  Ethan H Jun 18 '12 at 21:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.