Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This will sound naive for sure, and it is. Being a recent college graduate, I have been wondering on how do average websites implement their authentication modules. I have been using a table storing username and hash(password) and their roles (for authorization). All I do is string-matching and done! Then install an SSL cert. This sounds too simple in practice !!

Then I look at the enterprise systems which implement JAAS and stuff like that, which sounds too complex for a small-medium business.

How does an average team consider writing an authentication/authorization module ? This is a language/platform agnostic query. I would be obliged to get any suggestions.

Thanks !

share|improve this question
Guys, why was this down-voted? The OP is trying to improve his knowledge. We should encourage this, not the other way around. – Ion Oct 11 '13 at 10:51
up vote 6 down vote accepted

You don't. You use the authentication and authorization modules provided by your framework.

My goto web framework is Python's Flask framework. Flask-Login is an excellent module that provides an easy to use API that handles the bulk of the authentication work. Flask-Security is another module that encompasses Flask-Login as well as various other security modules. This isn't unique to Python and Flask. Java for example, has Apache Shiro.

Don't roll your own. There are quite a few gotchas that you have to take note of when writing authentication and authorization code. Use battle-tested frameworks and save yourself the headache.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.