Not fully sure if these types of questions are allowed here, but don't see anything against it in the help centre so I'm assuming it is. Please point me to a better place to ask if it's not!
I'm making an account system for my website and trying to do my best to protect accounts from several types of attacks but a bit worried, possibly paranoid, that I'm going to miss some. I've not completed the sign-in page yet, but this is the code that allows users to sign up https://hastebin.com/isuhiwavex.php. Currently, I'm trying to:
- Protect it from bots, brute-forcing and other similar suspicious activity using ReCAPTCHA v3 (allowing scores higher than 0.5)
- Requiring passwords be more than 8 characters and contain both upper and lower case characters
- Encrypting passwords with Argon2id with paramaters that take ~0.5 seconds for my server to process (memory cost 20000, time_cost 17, threads 2)
- Making sure emails are in a valid format for XSS and general validity
- Formatting HTML special chars in the username, also for XSS
- Making sure accounts can't be created with usernames/emails that already exist
When I make the login page, the only extra I plan on adding is that only 3 login attempts can be made per minute per IP. I realise an IP isn't the best way of identifying people, but wasn't sure what else I could get that could be stored in my database easily.