What is the best authentication script?

Question

Hi, I'm planning on making some dynamic PHP websites and I need a free Authentication system that allows me to create control panel for these sites' admins. It should contain :

• Remember password
• Lost password
• Maximum login attempts per specific interval
• users Management

Thanks.

Answer 1

As a beginner, I suggest googling for tutorials, and considering using a PHP framework like Zend Framework.

Authentication is one of those things that seemingly 90% of beginner developers want to use a prepackaged solution for, yet none of them are sufficient.

Writing your own will improve you as a developer and teach you about a lot of core web development terms and technologies, such as:

• XSS
• Cryptographically secure hashing
• HTTPS/SSL
• CSRF

Answer 2

There are plenty of scripts out there that do this, if you're serious about PHP you should be able to write your own authentication script.

There are plenty of resources available to help you start, check out or simply google 'php authentication' (or something along those lines).

http://net.tutsplus.com/videos/screencasts/how-to-build-a-login-system-for-a-simple-website/ http://www.devarticles.com/c/a/MySQL/PHP-MySQL-and-Authentication-101/

However you should always take online resources with a grain of salt, many won't touch on the security aspects of user management such as XSS etc

You may also want to check out some PHP frameworks which have authentication libraries built in, such as CakePHP or Zend Framework.

Answer 3

There are no best one, and there is no serious solution that can be a script. Authentication is a global policy and therefor must be integrated with the entire Web site. Either code your own or use a framework that implements it.

If you start to code you own implementation, remember that the your first attempts can be used only for non-sensitive data, as they will be weak (but sufficient for a casual web site).

Stoosh has some good leads you may want follow.

Just remember this is not as trivial as it seems, and obvious solutions are likely the less secure. But again, you probably doesn't need CIA style security, so don't stress and enjoy learning programming.

Answer 4

Some security notes: In order to avoid many of the problems that fall into the authentication and authorisation groups of the OWASP webapp attack classification list, use the user authentication subsystems already implemented in your web framework of choice. They are likely to have already written secure code that covers a lot of the problems related to authentication and sessions and will likely be far more secure than anything you roll yourself.

If you absolutely, positively, must roll your own auth, or if you wish to assess another one; then you/they must follow these rules.

• Implement a suitably random and unguessable session id for use in the session cookie.
• Do not allow the session id to be forced.
• When permissions or credentials are changed (e.g. the user been upgraded to a higher security, the user has changed their password) then immediately invalidate the session and start a fresh one.
• Provide a logout feature, and invalidate the session upon logout.
• Set the cookie to HttpOnly
• Always expire sessions after non-use and do not implement "keep me logged in" by reconnecting the user to their old http session.
• Ensure 2 sessions can't have the same session id at the same time
• Ensure that all session data is destroyed when a session is invalidated. A new user coming along, may just happen to get assigned a session id that has been used previously. This new session must not have any access to session data that has been set previously against that session id.