Hi,
I wanted to post my login system I will use for an upcoming site for rating. I want to ensure a safe login, so please, if you know anything about this and see a security leak somewhere... Please post, any remarks are welcome.
How it works: the script generates a random number if the form hasn't been submitted yet. This number is being passed to the Javascript also. On submitting of the form the javascript creates a hash and empties the password field. The hash includes: IP + hashed password + random number. The server recreates this and destroys the session with the random number *. The two hashes are compared and a decision is made.
* I've been thinking of putting the random number in the database and an id in the session, then the random number is pulled of the database. However, I'm not so experienced in login systems and don't know what information can be corrupted.
NOTE: the script will also log who is currently logged in, I still have to code that part, but I couldn't wait to upload this here.
EDIT: I will include a script that will only allow for so much login attempts in a certain time span to exclude bots. Or shouldn't I? :)
<?php
session_start();
include_once("connect.php");
if(isset($_POST['logIn'])) {
$RND = $_SESSION['RND'];
session_destroy();
$IP = $_SERVER['REMOTE_ADDR'];
$qGetUser = @mysql_query("SELECT * FROM users WHERE gebruikersnaam='".$_POST['username']."'");
if(@mysql_num_rows($qGetUser) == 1) {
$aGetUser = @mysql_fetch_assoc($qGetUser);
$serverHash = sha1(($IP.$aGetUser['wachtwoord'].$RND));
if($serverHash == $_POST['hash']) {
$msg = "NICE!";
$type = "notification";
}
else {
$msg = "fail :( serverHash: ".$serverHash." ; clientHash: ".$_POST['hash']." ; wachtw: ".$aGetUser['wachtwoord'];
$type = "error";
}
}
else {
$msg = "De ingevoerde gebruikersnaam is ongeldig.";
$type = "error";
}
}
else {
$_SESSION['RND'] = getRandomNumber();
}
function getRandomNumber() {
srand(time());
return (rand()%1000001);
}
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<meta http-equiv="Content-type" content="text/html;charset=UTF-8">
<title>Vermeersch Constructie</title>
<script type="text/javascript" src="MooTools_Functions.js"></script>
<script type="text/javascript" src="MooTools_BackEnd.js"></script>
<!--[if lt IE 7.]>
<script defer type="text/javascript" src="pngfix.js"></script>
<![endif]-->
<link rel="stylesheet" href="style.css" type="text/css">
<script type="text/javascript" src="sha1.js"></script>
<script type="text/javascript">
function hashIt() {
var password = document.getElementById('password').value;
var ip = document.getElementById('ip').value;
var randomnumber = <?php echo $_SESSION['RND']; ?>;
document.getElementById('password').value = "";
document.getElementById('hash').value = hex_sha1((ip + hex_sha1(password) + randomnumber));
}
</script>
</head>
<body>
<div class="header"></div>
<div class="container">
<?php
if(!empty($msg)) {
showMsg($msg, $type);
$msg = null;
$type = null;
}
?>
<form method="post" action="" onSubmit="hashIt();">
<table>
<tr>
<td>Gebruikersnaam:</td><td><input type="text" name="username"></td>
</tr>
<tr>
<td>Wachtwoord:</td><td><input type="password" id="password"></td>
</tr>
<tr>
<td> </td><td style="text-align: right;"><input type="submit" name="logIn" value="Aanmelden"></td>
</tr>
</table>
<input type="hidden" name="ip" id="ip" value="<?php echo $_SERVER['REMOTE_ADDR']; ?>">
<input type="hidden" name="hash" id="hash">
</form>
</div>
<div class="footer"><div style="padding: 6px;">© Debaere Brecht</div></div>
</body>
</html>Thanks :), please post comments on it
