Question

I have created this php-Login, which will serve as a template.

https://github.com/sinky/php-login-boilerplate

My question, is this php-Login secure? Does it work proper?
Is it possible to get logged in without the password?
(SSL is not taken into consideration.)

Thank you for improvements.
Greetings Marco

Answer 1

No.. not really.

This is vulnerable to CSRF:

if($_GET['logout']) {
  session_destroy();    
}

This is trivial to bypass, just clear you cookies each time you attempt to login:

sleep($_SESSION['loginFail']);

This is good behavior:

header("location: login.php");
exit;

Keep in mind header() doesn’t stop the script from executing. Also yes, both the login and the session id must always be transmitted over HTTPS (read: OWASP A9).