What’s the best way to handle logins?
My answer to What’s the best way to handle logins? on Quora
First, make sure you’re storing the password as a salted hash, using a deliberately slow hashing algorithm such as bcrypt, scrypt or PBKDF2—here are some recent articles to get you up to speed:
Here’s a recent article on building a password reset function, from the same author:
There are a couple of ways you could deal with keeping people logged in. The first, and probably the most sensible, is to use a session mechanism written by someone else (PHP has this functionality built in, I’m not sure what the state of the art for Perl is). Alternatively you could use a cryptographically signed cookie, but don’t do that unless you’re certain you understand what that means.
It should go without saying, but don’t store the user’s ID in a cookie and trust that—cookies can be altered so you can’t trust them unless they are signed. Don’t store the user’s password in the cookie either.
More recent articles
- Weeknotes: Parquet in Datasette Lite, various talks, more LLM hacking - 4th June 2023
- It's infuriatingly hard to understand how closed models train on their input - 4th June 2023
- ChatGPT should include inline tips - 30th May 2023
- Lawyer cites fake cases invented by ChatGPT, judge is not amused - 27th May 2023
- llm, ttok and strip-tags - CLI tools for working with ChatGPT and other LLMs - 18th May 2023
- Delimiters won't save you from prompt injection - 11th May 2023
- Weeknotes: sqlite-utils 3.31, download-esm, Python in a sandbox - 10th May 2023
- Leaked Google document: "We Have No Moat, And Neither Does OpenAI" - 4th May 2023
- Midjourney 5.1 - 4th May 2023
- Prompt injection explained, with video, slides, and a transcript - 2nd May 2023