Feedback #2 (under assignments) Lecture Code:

Today’s Agenda Course Feedback Announcements Building a Login System Wrap Up

Announcements Last Day of Class Today Interest in Presenting Final Projects? FP Deadlines 12/6 Photoshop Layout 12/13 Entire, Fully-Functional Project

Web Design: Basic to Advanced Techniques Fall 2010 Mondays 7-9pm 200 Sutardja-Dai Hall Building a Login System

Login Systems

Functionality Login Verify Credentials Logout Remember Me Register

Components Front End Form Back End PHP for Authentication Database login, password search for user with given login encrypted password authenticated session id

Form Browser Code

Database loginpassword alexiliketowork jonpeaches amberpeaches michaeldatabasesarecool Totally insecure! What if someone hacks your database? Can discover all passwords. Can log in as anyone.

Database Improved Better, but… Leaks information. loginencrypted password alexdjfxsfr2NIMmu2W0 jonxGBfwjvdK3A4VgjY amberxGBfwjvdK3A4VgjY michael3FI1IiNJZ6QjAkdQ If someone hacks database: Or can they? Can notice Jon and Amber have same password. CanNOT log in as anyone.

Database Best Secure! Assuming random salt and cryptography done correctly. loginencrypted password salt alexdjfxsfr2NIMmu2W0B1USHXMZ3JgkOTDW jonxGBfwjvdK3A4VgjYTCRJRrLR0MpdcgtX amberxKomGtFIOELCO3ccUySPSuyJPQoIfgE5 michael3FI1IiNJZ6QjAkdQzj1NfuTT7uJxpCaV

Database Takeaways Never store plain text password! Compare encrypted passwords instead. Use a random salt to prevent information leaks.

Authentication verify log in credentials 1. User submits login and password via form 2. PHP retrieves posted information via $_POST[’login'] and $_POST[’password'] 3. PHP runs database query: SELECT * from Users WHERE login = $_POST[’login’] 4. Authenticate Encrypt(POST[’password’], $row[‘salt’]) == $row[‘encrypted_password] HUGE security vulnerability, Use prepared statements instead

What if we visit a new page? We would need to ask for credentials again. What a bother! Why? Because HTTP is stateless. How do we fix this? Sessions.

What should happen After logging in initially we want to be able to stay logged in until we close the browser or log out. Also want the site to remember who we are.

We need some sort of state, memory, between page loads. Could store: as cookies And send cookies every time we load a page. Server could then check that we’re logged in and know who we are logged in as. Cookies to the Rescue? User ID599 Logged In1 Issues? Totally insecure! Could log in as who ever you want.

We need state, but we can’t store sensitive data on the client side. Thankfully there is server-side state! Could store: But how do we identify which stored record belongs to a particular client? Need to store an identifier too. Sessions server-side state User ID599 Session IDUser ID

What’s Inside Each? CookiesSessions Session IDUser ID Session ID1 Secure? Nope. Can change our cookie to hijack other sessions.

What’s Should Be Inside Each. CookiesSessions Session KeyUser ID XGnCmUE2dV3sTnA6599 KHmA2XiScwgPy70w458 Session KeyXGnCmUE2dV3sTnA6 Secure? Yes. As long as our Session Key is random and sufficiently long (enough entropy).

Initial Interaction Front End Form Back End PHP for Authentication Database login, password search for user with given login encrypted password authenticated session key

Subsequent Interaction Browser Back End PHP for Authentication session id private web page Session KeyXGnCmUE2dV3sTnA6 Session KeyUser ID XGnCmUE2dV3sTnA6599 KHmA2XiScwgPy70w458

Session Hijacking Session key is king. If someone is able to determine the value of your session key they can send the same cookie to the server and have access to your full account. Firesheep

Making Session Hijacking Harder Unique Request Headers HTTPS Also session fixation attacks...

Writing Your Own Authentication System Is very hard Lots of things have to go right to make it secure and one thing wrong can jeopardize the entire system’s security Look for a reputable plugin Use establish encryption techniques

Web Design: Basic to Advanced Techniques Fall 2010 Mondays 7-9pm 200 Sutardja-Dai Hall Semester Wrap Up

What We’ve Learned HTML CSS jQuery (JavaScript) PHP MySQL

What Now? Forget PHP Want to build Facebook in a month, by yourself? Learn: Ruby on Rails! Still need all our knowledge of HTML, CSS, jQuery, MySQL CS169 Great rails resource:

Keep in Touch… Let me know what you’re up to… What you’re building… If you need advice… Facebook Group or

Additional Resources General Web Design/Development Tutorials: Photoshop Tutorials: Awesome Web Designs:

Feedback #2 (under assignments) Lecture Code: