So i'm in the process of making a login form for users, and I'd like to make things as secure as reasonable. It's a consumer site, not a financial site, but seeing how I myself like things to be secure when I login to a website, I try to keep things as secure as possible in my form.
Steps I have taken so far:
The password is hashed with bcrypt.
For the login form i'm using a csrf_token generated by hasing bcrypt from
- user ip
user id is generated for each user that visites on the basis of GUID when they are not logged in yet, this is stored in the session on first site access and not visible to users.
The csrf is not re-generated for each for each page request because of history issues and like stated, we are not a financial institution and for any plugin it's trivially easy to harvest any csrf tokens. So that's a step I don't need to take to secure the page(what i've read on this site anyways)
cross site scripting is disabled.
X-Frame-Options: SAMEORIGIN headers
The question: Are there any other steps I can take/need to consider that will secure the login/user interaction process?