0

I am trying to develop a social media app and website. The problem is I am trying to find a secure way to work with logins and sessions since other methods don't seem good or have better ways.

For the website, once you log in if the password and username match should I save a session as a cookie or create some type of token? I would rather it not expire because that would be inconvenient for users but I want it to be secure at the same time.

For the app, when you log in should I also save a session and work with that? Or should that also have a token that auto-renews? I don't want it to keep requiring the user to log in since that would drive people away.

I am using the following software and languages:

  • App: Xamarin.Forms (C#)
  • Website: PHP
  • Database: MySQL

closed as too broad by Anders, Steffen Ullrich, LvB, ISMSDEV, Overmind May 4 '18 at 12:51

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    your use case shares common requirements that many frameworks have already covered with well established patterns. Just pick up the right one for the language you are using and you will be safe. – elsadek Apr 28 '18 at 21:57
  • @elsadek I am looking for the best methods such as which to save [Session / Token / Username] on which [App \ Website] and how to renew them securely without user impact – Dan Apr 28 '18 at 22:29
  • 2
    PHP has session management, why don't you use that? – Neil Smithline Apr 29 '18 at 1:16
1

PHP has built in session management that you could use - eg.

session_start();
<?php
    $_SESSION[] = something;
session_destroy(); <- when you want to end that current session
?>

For your form action: <?php echo($_SERVER[PHP_SELF]);> to mitigate xss

if you use this method, each session will assign a user-key on the users machine and when a session is opened elsewhere, it scans for that key - if it matches it accesses that session - if not then it starts a new session.

You can use session_destroy() to kill all session data for that useror session_unset(); to destory a particular session.

If you are using an sql database then you have to ensure that validation is being performed - otherwise you leave your web app open to a number of attacks, ie. XSS, SQLi, etc. which can leak out your users data, for a social media app / website that is very bad for obvious reasons. For a login field for example - something like this would be secure:

<?php
    function clean($string)                    //custom cleaning with regex
    {
        $string = str_replace(' ', '-' $string);
        $string = preg_replace('/[^A-Za-z0-9\-]/', '', $string);
        return preg_replace('/-+/', '-', $string);
    }

    if(isset($_POST('submit')))               // built in sanitising
    {
        $sanitised_name = filter_input(INPUT_POST, 'username', FILTER_SANITISED_ENCODED, FILTER_FLAG_STRIP_HIGH);
    }

    echo $sanitised_name;                    // print out the sanitised name
    echo .clean($_POST['username']).;        // print out using the custom function

   ?>

Above shows two different ways you can achieve very similar results with built in functions. the first block uses regex that you could restrict to whatever character set you wanted your users to use, while the second block uses the built in functions that PHP has - the end just echo's out so you can see the difference for whatever input you use.

EDIT: When storing your users usernames and passwords you should store the plaintext name in your database, but passwords should be salted and hashed, so rather than checking if a username and password matches, check if a username and password hash match what you have in your database - but make sure you set up a secure connection first before a user submits anything - otherwise they are sending information to your site unsecurely - quite easy for someone to MITM and steal credentials.

I actually wrote a paper that specifically deals with securing PHP, SQL, cookies and sessions from attacks like XSS, SQLi, session hijacking etc. if its any use to you i'll leave a link to it below since it goes into more detail: https://github.com/TheresAFewConors/Security/blob/master/Web%20Application%20Security.pdf Just as a disclaimer I don't work in security - i'm a student studying compSec but hope to work in the industry in the next couple of years - if there's anything missing or better than my answer ill happily edit it to improve it since some people on here are extremely knowledgable!

Good luck with with the social media app and website - its good to see that you are wanting to make it secure from the start!

Not the answer you're looking for? Browse other questions tagged or ask your own question.