CODEWITHSUNDEEP
phpsecurityencryptioncryptography
TheNone
TheNone

Reputation: 5802

Encrypted user credentials when they are transmitted

How can we encrypted user credentials when they are transmitted with php? (in login forms)

Thanks

Upvotes: 2

Views: 2833

Answers (4)

rook
rook

Reputation: 67019

"user credentials" are not just the username and password. A user credential is any data that is used for authentication. There is no point in using https for the login page if you just spill the session id a few milliseconds later by using http. The session id, is a credential and must be protected just like a username/password.

You must use https for the entire session. Spilling the session id over HTTP is a clear violation of The OWASP top 10: Broken Authentication and Session Management.

Upvotes: 3

Sjoerd
Sjoerd

Reputation: 75619

You can use one of the following to prevent the password being sent over the line in plain text:

  • Use HTTPS.
  • Use HTTP Digest authentication.
  • Encrypt the password using Javascript.

Upvotes: 3

Artefacto
Artefacto

Reputation: 97835

The easiest way is to use a form action that's a https url, e.g.:

<form action="https://example.com/target.php" method="post">

Alternatively, you could do some kind of digest authentication. The server would send a nonce and a challenge and you, via javascript, would use that data and the password to build a digest you'd send the server for it to check. For an example, see HTTP digest authentication.

Upvotes: 3

Mark Baker
Mark Baker

Reputation: 212422

The best method is to use ssl (an https page) for your login

Upvotes: 3

Related Questions