1. Web Systems Development (CSC-215)
Lecture 13: HTTP Authentication

2. Class Test 3 Wednesday 4th April Lecture 12 & 13
Lab question (remember to bring laptops)

3. Saving State
Query strings
Cookies
HTTP authentication
Sessions

4. HTTP Authentication
Uses web server to manage users and passwords for the application
Adequate for simple applications that require logins – but not enough for specialized needs

5. How does it work?
PHP sends header request asking to start an authentication dialog with the browser
Server must have this feature turned on for it to work (setting is usually on in most cases)

7. On Cancel

9. After entry

11. Note
After username & password have been entered, all browser instances need to be closed to run the script from scratch

12. Check for valid username and password

13. Storing User Names & Passwords
Use databases, but even there, storing in plain text is not the best idea
Use a one-way function
Converts a string of text into a seemingly random string
One way, so virtually impossible to reverse
Output can therefore be saved in database
Even if someone manages to access it, it will be unusable

14. Storing User Names & Passwords
Algorithms no longer recommended for use: md5, sha1, sha2
Use PHP hash function with the ripemd algorithm
Returns 32 character hexadecimal number

16. Hash function benefit
Just update function when there are developments in security algorithms

17. Salting
To overcome deficiencies in hashing (use brute force on database of known tokens)
Simply addition of some text that only you (the programmer) know of

19. Create user table and add two accounts

24. Proper User Authentication

28. Practice Activity Create a database of three users via script
Implement the authentication script (as give in the previous slides)

29. Lecture content adapted from chapter 13 of Learning PHP, MySQL, JavaScript, CSS & HTML5 & chapter 10 of Beginning PHP 5.3