Designing a Login Process for a site

[nathj]

Hi,

I have a quick favour to ask - would someone please check over this concept for me?

Basically I need to generate a login script and while time is on my side I want to invest in writing my own so that I fully understand and can fully control what is going on.

When a visitor applies for membership they assign themselves a password that is hashed and stored in the database. I do not have, nor do I want a remember-me (stay logged in) function, in the days of modern browsers this seems a bit pointless. That aside, I have planned the process for the login and was hoping someone might be able to point out any flaws with it.

At the top of each page is the login form - two text boxes and a button.

1) The user completes the details and clicks 'Login'.

2) The login script stores what page they are currently on.

3) The form is written with the current page as the action and post as the method.

4) I have a file that hashes the password and then checks the database. This file is included at the very top of every page.

5) If the details are correct then they see the page they were on at the start of this process and the login controls are replaced with a link to the members area and certain items on the navigation bar become available. I then store true to $_SESSION['isLoggedIn'].

6) If the details are wrong they go to a page with the controls on a link to request a new password.

I should say that the navigation is controlled by a database and the user details are also stored in a database.

I know that this is a high level of abstraction, even for pseudo code, but does this process flow sound ok?

I would really appreciate some feedback or pointers - pitfalls to avoid, that sort of thing.

Cheers
nathj

[pbmods]

Changed thread title to better describe the problem (did you know that threads whose titles contain three words or less actually get FEWER responses?).

[gregerly]

Your process seems like it should be fine. The process that I use is:

1. User supplys credentials thru form.
2. Processing script searches the users database for that username and password combination.
3. If the code selects a record then the user exists and is redirected to where ever you want them to go.

if you are submitting to the same page as the form just do a check like:

[PHP]if($_POST['submit']){//the name of the submit button
//login code here
}[/PHP]

Be careful with the use of $_SERVER['PHP_SELF'], some one on this board, I think veloelectric (sorry if I misspelled your name) had a good tutorial about why it's not a great Idea to use PHP_SELF as a form action. Look into that.

Otherwise I think your on the right track.

greg

[kovik]

I have a quick favour to ask - would someone please check over this concept for me?

Concept and code are very different. You could likely have a huge security hole, but think that since the 'concepts' were correct, the code is as well.

1) The user completes the details and clicks 'Login'.

2) The login script stores what page they are currently on.

The login page...?

3) The form is written with the current page as the action and post as the method.

4) I have a file that hashes the password and then checks the database. This file is included at the very top of every page.

A *file* that hashes the password? That sounds wrong.

5) If the details are correct then they see the page they were on at the start of this process and the login controls are replaced with a link to the members area and certain items on the navigation bar become available. I then store true to $_SESSION['isLoggedIn'].

For security purposes, we prefer to check the user against the database with every page request.

6) If the details are wrong they go to a page with the controls on a link to request a new password.

The "forgot your password" link should be on the original login form in the first place. If they forgot, they likely know before they try to guess.

[kovik]

[PHP]if($_POST['submit']){//the name of the submit button
//login code here
}[/PHP]

You shouldn't check for the submit button because the button itself is not always submitted. Try doing it in IE6 and pressing "Enter" instead of the button. (I believe it's fixed in IE7, but a lot of people still use IE6).

[nathj]

Wow, there's lots to respond to here. This is great.

(Note: I type my reply ijn textpad hence I don't have any quotes in it)

First of all sorry about the title - I can't even remember what it was called now. Thanks for improving it for me.

I wouldn't use $_SERVER{'PHP_SELF'] as the form action, I would use something else to determine what the current page is so that the form could then utilise that.

Volectricity, thanks for pointing out some concerns.

I'm aware that code and concept are different and when I have the code developed I may ask a similar favour here on TSDN to complement my testing procedures.

The login form appears on every page at the very top. Take a look at the site - but remember the login goes no-where and the membership form is currently incomplete as I need to purchase a credit pack for the address search. You should see what I mean by the login items appearing on every page.

As a for a file that hashes the password. This is a poor explanation on my part. There is a class on which there is a function that will hash the password. Does that sound better?

When you say you would check the user against the database on every page - this makes sense as it means the $_SESSION can't be manipulated, would run the full username and password check again?
I will take on board the 'Forgot your password' suggestion though - that's going to improve accessibility.

Okay, I think I've managed to respond to everything listed. Once again I really appreciate the help.

Cheers
nathj

[gregerly]

You shouldn't check for the submit button because the button itself is not always submitted. Try doing it in IE6 and pressing "Enter" instead of the button. (I believe it's fixed in IE7, but a lot of people still use IE6).

Good call volectricity. You learn something new everyday. I didn't realize that in IE 6 a button had to be clicked to be included. Again, nice call.

Greg

[gregerly]

Take a look at the site - but remember the login goes no

I think my favorite part about your site is the images you lifted from iStockPhoto.com without removing the watermark! You might want to purchase the images before a live release of your site.

[nathj]

I think my favorite part about your site is the images you lifted from iStockPhoto.com without removing the watermark! You might want to purchase the images before a live release of your site.

Thanks for taking a look.

Those images are place holders only. I am currently in talks with a number of design companies and part of the remit is to production/acquistion of images for the site.

I should stil lpay for them I know, it's on the list but hasn't been done yet.

Cheers
nathj

PS I'm not a copyright thief, I give credit for the work of others and I won't be using nicked imanges for the live site.

[ktdabull]

Originally Posted by gregerly
I think my favorite part about your site is the images you lifted from iStockPhoto.com without removing the watermark! You might want to purchase the images before a live release of your site.

Now that is funny. =o)

Oh just kidding, your site IS actually live though. I dont see much harm in it anyways, I have done comps in the past to show off the work. Which your sitch is similar to my case.




Cheers

[pbmods]

Sorry, ktdabull. Had to remove politically-sensitive content from your post. It goes against the Posting Guidelines to post that sort of thing.