Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am creating a website that needs user authorization. It is my first time creating a website to go live, and also my first time trying to do any form of authorization. The following is my plan, will you please tell me if I have any obvious loop holes and if there is anything else I should be aware of. If interested or relevant I'm using a restful nodejs and mysql back end and backbone on the front end.

Log in process:

  1. The user attempts to log in. That sends an email address and a password and an randomly generated key (haven't decided on an amount of bits).
  2. The authorization server accepts this information, it encrypts the email address and password, and checks it against the values in the user_auth table of the authorization database. If there is a match, it creates a session id.
  3. The authorization server then places the session id, email address, and user generated random key into a row of the session table (in the data database accessed mainly by the data server), and sends the user back a session id and any other relevant page data that is encrypted using the session id as a key.
  4. On success of all of this the user receives the session id and decrypts the additional data and all future data using the session id.
  5. On each action taken by the user, the client will send the email address and session id encrypted with the original randomly generated key that was sent to the data server, and if the session id and email address match, the data is decrypted using the key, and then the data is attempted to be processed.

I will also of course attempt to sanitize all data before a sql query is generated, there will be live form validation and backbone model validation as well. The mysql user that the nodejs servers will use will not have delete permissions which will be taken care of via being tagged and a daemon running on the back end.

To create an account:

  1. The user will submit an email address, password, first name, last name to the authorization server.
  2. The authorization server will place this along with a datetime in a temp_user table and a nicely worded email will be composed with a session id built into the url.
  3. The user will click the link in the email to which they will be taken to a "your account has been validated page" or something. Clicking the link will save the session id value into the client's code and create a randomly generated key that is sent to the server. On success it will actually show the user the page.
  4. On the server side the authorization server will place the username and password, encrypted, into the user_auth table of the authorization database, place the first and last name into the user table in the data database, and then delete (the only table it will have delete permissions for) the corresponding row in the temp_user table.
  5. Now the client and server should be on the same page as in the first scenario.

if at any point the session id is null or does not match the user will be asked to log in again ans the process will start over.

Is there anything I am missing?

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

Don't reinvent the wheel.

First of all I would advise using an existing session handler and authentication system. nodejs is popular and there are a lot of libraries that you can use. OAuth is a beautiful standard, and will protect your users.

That being said, there is a lot missing from this list. I recommend reading the OWASP Authentication Cheat Sheet and the OWASP Session management cheat sheet. Also read the OWASP top 10 as many of these issues can lead to a compromised session or account.

Some of the biggest problems with your design: use HTTPS for the life of the session, never encrypt passwords, they must always be hashed. Also, a lot can go wrong "encryption", this is not a magic wand, and very few developers implement this properly. (After all no one can crack DOUBLE rot-13 encryption, because its fucking "encrypted"... twice).

share|improve this answer
    
I appreciate your link for the OWASP site. I've been looking for something like this and hadn't been able to find it. –  The Composer Aug 12 '13 at 18:27
add comment

Is there anything I am missing?

Yes, there is something you are missing. I'm not familiar with Node.js but I can guarantee you that there are existing implementations of authentication and authorization libraries.

Using an established library will save you a lot of headaches when it comes to protecting against the edge cases so make your life simple and pick a well-vetted library and use it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.