I am creating a website that needs user authorization. It is my first time creating a website to go live, and also my first time trying to do any form of authorization. The following is my plan, will you please tell me if I have any obvious loop holes and if there is anything else I should be aware of. If interested or relevant I'm using a restful nodejs and mysql back end and backbone on the front end.
Log in process:
- The user attempts to log in. That sends an email address and a password and an randomly generated key (haven't decided on an amount of bits).
- The authorization server accepts this information, it encrypts the email address and password, and checks it against the values in the user_auth table of the authorization database. If there is a match, it creates a session id.
- The authorization server then places the session id, email address, and user generated random key into a row of the session table (in the data database accessed mainly by the data server), and sends the user back a session id and any other relevant page data that is encrypted using the session id as a key.
- On success of all of this the user receives the session id and decrypts the additional data and all future data using the session id.
- On each action taken by the user, the client will send the email address and session id encrypted with the original randomly generated key that was sent to the data server, and if the session id and email address match, the data is decrypted using the key, and then the data is attempted to be processed.
I will also of course attempt to sanitize all data before a sql query is generated, there will be live form validation and backbone model validation as well. The mysql user that the nodejs servers will use will not have delete permissions which will be taken care of via being tagged and a daemon running on the back end.
To create an account:
- The user will submit an email address, password, first name, last name to the authorization server.
- The authorization server will place this along with a datetime in a temp_user table and a nicely worded email will be composed with a session id built into the url.
- The user will click the link in the email to which they will be taken to a "your account has been validated page" or something. Clicking the link will save the session id value into the client's code and create a randomly generated key that is sent to the server. On success it will actually show the user the page.
- On the server side the authorization server will place the username and password, encrypted, into the user_auth table of the authorization database, place the first and last name into the user table in the data database, and then delete (the only table it will have delete permissions for) the corresponding row in the temp_user table.
- Now the client and server should be on the same page as in the first scenario.
if at any point the session id is null or does not match the user will be asked to log in again ans the process will start over.
Is there anything I am missing?