Question

There are lots of ways to create a login form for web apps and most of them are flawed one way or the other:

• Passwords are transmitted/saved as clear text
• The login dialogs are subject to XSS attacks or SQL injection

Is there an example or tutorial how to create a secure login form?

Answer 1

I agree with Carlos about lack of “perfect” secure system, not only for login, but for any other component. The only thing to do is to minimize risks by following best practices, but always keeping in mind that total safety doesn’t exist, so your question is quite difficult to answer, although there are some good examples out there nothing is perfect, security is a very fast evolving topic.

For me the main things to solve are:

-Data transmission: The user is always going to type a password and this has to be sent to your system before it was processed, so there is a high risk of being intercepted if you are using an open channel. To solve this you MUST use transport the data over an encrypted channel (SSL), no other way unless you drop the common password (for example using one-time use tokens, or delegating the authentication to a third party, like Facebook connect or openId). See “How to Make a Secure Login Form with SSL”

-Input Sanitation: To avoid XSS and SQL Injection consider any input that comes from a client as a potentially risk point, therefore you have to perform validation against anything that comes form outside –> doc. Another good practice is never use the inputs directly on queries, use as bind variables in prepared statements or stored procedures.

-Password Storage: Password should always be stored encrypted with a one way hash algorithm, so even in the case of someone accessing your DB, there is no way to recover the original passwords. Also use techniques as Salting, Hashing multiple times, etc… Also be careful to choose an algorithm that is not weak or outdated (like MD5), which can be broken by brute force easily with the increasing CPU power.

-Infrastructure: Have your machines, OS, frameworks, libraries always updated to avoid bugs and 0 day attack. Any system today is enormously complex, and the system is as secure as it weakest component.

-Other Things to Consider: Review your security policy regularly to see if needs to update anything, implement password policies (expiration, reuse, etc…), log access, use monitoring tools for your systems, etc etc etc

And after all that, you can still be sure that if someone has enough time and resources, your system will fall.