I read though OWASP very carefully, but I am not sure about some parts of my website.
I am using jbcrypt on my website. It stores the salt in the hash itself something like this hash+salt. I read somewhere that I should store the salt on a different database otherwise I would be vulnerable to rainbowtables again.
My framework is very new (Play! framework 2.x) and I have to do some cookie management. The framework offers signed sessions. However those "sessions" are no sessions they are only SessionCookies. Also I had to sign the cookies by myself.
The session cookie vanishes after the user closes his browser and I need a more permanent solution.
What i did:
If the user succesfully signs in:
- I create a random string and put in it my Cache
randomstring -> user
- I hash the random string an put it in a cookie.
- Now if the user has a valid cookie, I will create a "session" from the cookie.
I am not 100% sure if this is correct, but this is what I thought would be correct.
Ressource : Is this approach of securing cookie secure? and www.OWASP.com
- Now this part could be dangerous. I have a config-file in my sourcecode -> All passwords a stored in the same place.
I couldn't find anything about this. Where should I store those credentials like AWS-credential, db passwords, mail password ...?