PHP Login/Authentication/Sessions/API/Token -


i need develop secure login system.

i have api layer, , plan create token table. i'll send username/password (post) api , generate unique token (one time token limited time), return token in json.

my questions are:

  1. what should saved in sessions while user logged in. want store little possible information. should save token only? safe?

  2. i don't want store access levels , user info in session, need these info each time via token.. think? advice!

  3. any other advice develop more secure login system.

thank in advance.

since you'd keep sessions logged in identification, encounter problem: clients can't kept session.

for example, cell phones, web-based app.

i'm creating similar project. , solution

  1. creating table named session (or whatever want), keeps usertoken (randomly generated), userid, tokenexpire.
  2. once user logged in, create record @ session table, , return token user (encoded json).
  3. user keeps token own, , attached token on every request. (no matter body or header, i'm using header separate data).
  4. check token every time before asking something. example, token exists? token expired? user blocked?
  5. by step 4., can user querying relatively.

that solution. it's similar way.

additionally, improve security, follow ways if could

  1. use ssl (http) secure connection between server , clients.
  2. don't keep password plaintext. should encrypt them.
  3. you can generate token longer possible.
  4. the token field of session table, should case sensitive. change collation different _ci (means case insensitive)
  5. check post data prevent sql injection. never trust users give you.

the instructions above fundamental. that.


Comments

Post a Comment

Popular posts from this blog

iOS: Performance of reloading UIImage(name:...) -

i have tableview , each row has icon. 90% of rows have same icon. in cellforrowatindexpath method load image assets folder this: var cellimage = uiimage(named: "myimage") does pose performance problem? os somehow smart enough it's same image each time? better if loaded image once , saved in class variable , assigned each time? uiimage 's named: api does kind of caching. if @ uiimage's documentation , states: use init(named:in:compatiblewith:) method (or init(named:) method) create image image asset or image file located in app’s main bundle (or other known bundle). because these methods cache image data automatically, recommended images use frequently.
Read more

How to prevent logback from emitting repeated "Empty watch file list. Disabling" messages -

i have logback configured logback.xml located here: http://pastebin.com/kuquekxy . every minute, see log message emitted of form: 18:26:21,486 |-info in reconfigureonchangetask(born:1478715201485) - empty watch file list. disabling why happening , how can rid of these? i can tell why happening, not how rid of them. the reconfigureonchangetask log line when doesn't have files watch. and doesn't have files watch because file in jar, , only watch files on filesystem . makes sense, because files within jar file don't change.
Read more

c# SetCompatibleTextRenderingDefault must be called before the first -

i tried search exception couldn't find solution on case i'am using code below invoke .net application : assembly assem = assembly.load(data); methodinfo method = assem.entrypoint; var o = activator.createinstance(method.declaringtype); method.invoke(o, null); the application invoked has form , in entrypoint of application : [stathread] static void main() { application.enablevisualstyles(); application.setcompatibletextrenderingdefault(false); //exception application.run(new form1()); } setcompatibletextrenderingdefault must called before first iwin32window object created in application. edit : assembly = assembly.load(data); methodinfo method = a.gettype().getmethod("start"); var o = activator.createinstance(method.declaringtype); method.invoke(o, null); you should create new method skips initialization...
Read more