Web Systems Development (CSC-215) Lecture 13: HTTP Authentication

Class Test 3 Wednesday 4th April Lecture 12 & 13 Lab question (remember to bring laptops)

Saving State Query strings Cookies HTTP authentication Sessions

HTTP Authentication Uses web server to manage users and passwords for the application Adequate for simple applications that require logins – but not enough for specialized needs

How does it work? PHP sends header request asking to start an authentication dialog with the browser Server must have this feature turned on for it to work (setting is usually on in most cases)

On Cancel

After entry

Note After username & password have been entered, all browser instances need to be closed to run the script from scratch

Check for valid username and password

Storing User Names & Passwords Use databases, but even there, storing in plain text is not the best idea Use a one-way function Converts a string of text into a seemingly random string One way, so virtually impossible to reverse Output can therefore be saved in database Even if someone manages to access it, it will be unusable

Storing User Names & Passwords Algorithms no longer recommended for use: md5, sha1, sha2 Use PHP hash function with the ripemd algorithm Returns 32 character hexadecimal number

Hash function benefit Just update function when there are developments in security algorithms

Salting To overcome deficiencies in hashing (use brute force on database of known tokens) Simply addition of some text that only you (the programmer) know of

Create user table and add two accounts

Proper User Authentication

Practice Activity Create a database of three users via script Implement the authentication script (as give in the previous slides)

Lecture content adapted from chapter 13 of Learning PHP, MySQL, JavaScript, CSS & HTML5 & chapter 10 of Beginning PHP 5.3