What’s the best way to handle logins?
31st July 2012
My answer to What’s the best way to handle logins? on Quora
First, make sure you’re storing the password as a salted hash, using a deliberately slow hashing algorithm such as bcrypt, scrypt or PBKDF2—here are some recent articles to get you up to speed:
Here’s a recent article on building a password reset function, from the same author:
There are a couple of ways you could deal with keeping people logged in. The first, and probably the most sensible, is to use a session mechanism written by someone else (PHP has this functionality built in, I’m not sure what the state of the art for Perl is). Alternatively you could use a cryptographically signed cookie, but don’t do that unless you’re certain you understand what that means.
It should go without saying, but don’t store the user’s ID in a cookie and trust that—cookies can be altered so you can’t trust them unless they are signed. Don’t store the user’s password in the cookie either.
More recent articles
- OpenAI DevDay: Let’s build developer tools, not digital God - 2nd October 2024
- OpenAI DevDay 2024 live blog - 1st October 2024
- Weeknotes: Three podcasts, two trips and a new plugin system - 30th September 2024