Simon Willison’s Weblog

What’s the best way to handle logins?

31st July 2012

My answer to What’s the best way to handle logins? on Quora

First, make sure you’re storing the password as a salted hash, using a deliberately slow hashing algorithm such as bcrypt, scrypt or PBKDF2—here are some recent articles to get you up to speed:

• http://throwingfire.com/storing-...
• http://www.troyhunt.com/2011/06/...

Here’s a recent article on building a password reset function, from the same author:

• http://www.troyhunt.com/2012/05/...

There are a couple of ways you could deal with keeping people logged in. The first, and probably the most sensible, is to use a session mechanism written by someone else (PHP has this functionality built in, I’m not sure what the state of the art for Perl is). Alternatively you could use a cryptographically signed cookie, but don’t do that unless you’re certain you understand what that means.

It should go without saying, but don’t store the user’s ID in a cookie and trust that—cookies can be altered so you can’t trust them unless they are signed. Don’t store the user’s password in the cookie either.