0

I have a web site and a service in a server.

I'm developing the "Register User" and "Login" components.

I've searched on the internet and I've found two protocols to login user using 'nonce' and 'salt', here and here.

I've also found two explanations in order to use SSL/TLS, here and here, and bcrypt.

I believe these tips will help me a lot, however I have some questions:

How could I guarantee that only my client application will request a 'nonce' to my server? In other words, I would not like that others could request a 'nonce'.

1
  • I've removed your second part of the question "2) Would there be other things I should know to make my application as safe as possible?" since it is overly broad. Web application security is a huge topic and you only scratched the surface a bit. Commented Jul 1, 2020 at 18:08

1 Answer 1

2

A nonce is used in the process of authenticating the client. If you want to make sure that only your client application requests the nonce you need to have to add some authentication first - before accessing a nonce, i.e. authentication of the client application before doing authentication of the user. This might sound kind of silly - and it is not actually not needed.

There is no real need that only specific client applications can get a nonce. Properly implemented a nonce is cheap to issue and there is no need to restrict who can get one.

2
  • Now I get it. Thank you for your explanation. I'm new to these subjects, because of that, could you indicate to me any texts to read? Thank you.
    – rmmariano
    Commented Jul 1, 2020 at 18:39
  • @rmmariano: "... could you indicate to me any texts to read?..." - not really. While there are many resources (like OWASP) I don't know anything which works well for complete newbies in the area. And unless you like a steep learning experience (and a dangerous one if the server is public accessible) I recommend against implementing these things by your own. There are established web application frameworks which care about these aspects. Please refer to the documentation of these frameworks. Commented Jul 1, 2020 at 18:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .