A client connects to a server through an application (not a web browser) with a long-running TCP connection. TLS is used, so the communication is secure.

Is there a standard way to implement a password-based login mechanism in this scenario?

The simple option would be this: have the client submit a username and password just once after the connection is established, and then have the server hash the password and check against a stored value (again, just once). Since the TCP/TLS connection is stateful, I believe there is no need for session cookies/tokens. Is this simple option satisfactory?

  • Maybe pay attention to the hashing part, maybe you could use PBKDF2, bcrypt or scrypt or something newer. And of course, always use salt. – Aria Jan 27 '18 at 16:49
  • Agree, it's worth doing that part carefully. Does the simple option seem reasonable otherwise? – SauceCode Jan 27 '18 at 16:52
  • 2
    You aren't worried about session stealing? Not worried about malicious actors sending spoofed packets? You have not stated your requirements for "satisfactory". – schroeder Jan 27 '18 at 18:01
  • @schroeder That's why I'm asking the question! I'm trying to figure out if there's something I haven't considered. – SauceCode Jan 27 '18 at 18:27
  • There is a lot that you have not considered. This is not the right place to ask how to design an authentication system from scratch. Use the many Web based secure systems as design examples. – schroeder Jan 27 '18 at 18:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.