I'm working on a small side project in PHP. I may yet include some sort of actual username/password registration down the line, but for now, for ease of attracting attention, my goal is to allow for any anonymous user to use my site without registering. Here's how it works, in general:
- User goes to the site, and creates a "thing"
- In the response of create.php, user is given a randomly-generated string. This is not stored on the server, but its hash is.
- In the future, if the user wishes to make small changes to their "thing", they fill out a form on a page. Then, the request is sent with this localStorage string. On serverside, it is validated against the hash before updating the thing.
- Someday when I implement usernames/passwords, users can visit a page to gain ownership of their items by grabbing all their localStorage values.
A few things to think about:
eval(), and even try to avoid
innerHtml whenever possible. I'm especially aware of any times that user-generated strings are put to use. I think I'm helped by the fact that my site is not especially complex or user-customizable.
Also, I should note that the information saved on my site is best labelled as entertainment, and in its proper intent, should not contain sensitive information, even so much as E-mail addresses (those would come when I implement usernames/passwords) so I think I'm fine with someone being able to break in by physical access (ie, stealing a user's laptop); I'm basically trying to find the right balance of security to convenience.
I'm also now considering that, depending on how costly it is to get a certificate, HTTPS would be important enough to include. I guess I would just be surprised at someone watching HTTP packets just to take ownership of someone else's "thing".