18
votes
4answers
6k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first ...
3
votes
4answers
207 views

Securing opensource web application

I have an open source website. I need to add an admin section to the website which is accessible to only one person. To make it secure, I was thinking about providing a login page which checks if the ...
7
votes
3answers
4k views

Choosing a session ID algorithm for a client-server relationship

I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
2
votes
2answers
3k views

Is it safe to store password in PHP session?

I need to do some encryptions in the private zone of my website and I want to bcrypt the user's password. Is it safe to store the password in the session when user does the login, so that I can use ...
14
votes
6answers
829 views

Is This Login Security Enough?

I'm coming up with my next login system for admins of an ecommerce website to have login form is SSL secured password is converted to sha256 before being transmitted (bcrypt is too slow still for ...