Hi everyone,

 

I have been planning an idea for a large project for quite a while now and I'd like to have go at starting it soon. The only thing that's stopping me is I'm not confident in my current ability to create a secure enough member login feature, (which would be integral to the site's functionality).

 

I'm a fairly experienced programmer and have created similar login systems in the past, but only for hobby sites. My concern is that if I am creating (what I hope to be) a fairly high publicity site for clients I will need to do the login/ session stuff really well and securely, so as to prevent misuse and hijacking on the site (a prospect that scares me quite a bit!)

 

So I've been thinking recently it may be wise to use an open source system or a widely recognised one instead of writing the login/session code myself, as I am no security expert. Might anyone be able to offer any solutions that they know of, or perhaps some advice as to how difficult it would be to create a relatively secure system myself?

 

Kind regards and thanks

Aidan

What language are you looking to write this in? A framework would probably be a good choice here.

Hi Jack,

 

I'd be looking to work with PHP as this is where my experience lies.

 

 

Best
Aidan

Edited January 27, 201511 yr by aidanf

So I've been thinking recently it may be wise to use an open source system or a widely recognised one instead of writing the login/session code myself, as I am no security expert. Might anyone be able to offer any solutions that they know of, or perhaps some advice as to how difficult it would be to create a relatively secure system myself?

 

There are pros and cons to using a prefab login vs self built login. Whereas the prefab was written by (or you would hope) an experienced programmer is a plus, you need to also weigh up the fact that many popular installs offer anyone who has used the same product the 'inside information' on your structure, security and sessions. A scratch built setup is often considered more 'risky' but that said nothing a read through hashing, salt etc wouldn't resolve. In scratch built favour the very fact it's 'custom' means directory paths, includes, validation etc can be whatever you want them to be making it harder for penetration and hijacking.

 

Just my 2 pence worth.

Hi Jack,

 

I'd be looking to work with PHP as this is where my experience lies.

 

 

Best

Aidan

 

There are loads of great PHP frameworks that handle a lot of that for you, but still give you the clean slate you need. Laravel is great for this kind of stuff, tonnes of web apps are built with it, it has a good community and plenty of tutorials.

 

http://laravel.com/docs/4.2/security

Version 5 has been released today!!!!!!!!

 

I saw that yesterday on HN, but I couldn't see a feature roundup anywhere.