<geekwagon.net />: A Real Ajax Login System <geekwagon.net /> Sometimes something cool falls off. Home Blog Friday, December 12, 2014 A Real Ajax Login System Dashed borders lets you know this is hard core web design. Demo | Source After a bit of Google searching, I could not find the login system I want. I would say 'fit my needs', but that's not accurate. There were tons that could fit the need, but I want a back end php system that allows a user to login by way of ajax calls. Specifically one that didn't require all my file names to end in .php. Is that necessary? No. Is that being picky? Probably. Is it fun to make it work anyway? Of course. There are plenty of php ajax style login systems and examples out there. I started with this one from 9lessons. I have no right to complain about other people's work, but wow this code is hard to read and inconsistent. It works though, so I chose to clean it up and start making changes. DISCLAIMER: I would like to note I am not a security expert. While I feel this system is decent enough, I cannot advise using it in a real application environment. Here is a demo, note all pages end in html. You can log in with demouser and password, but check out the registration. That's where most of the magic is. The demo stored passwords as an MD5 hash--at least it's not plain text, but I thought it would be worth while to change this to use PHP's password_hash and password_verify functions. This effectively made the minimum PHP version requirement 5.5.0, which wasn't a problem at home, but for the demo I had to include this library to make it work with 5.4.0 (Dreamhost!). I also changed the database connector to PDO instead of mysqli. This way it can be used with any database (changeable in the config.php file). This has the advantage of not be vulnerable to sql injection. The biggest reason for the security disclaimer above is I am not sure of the security risks posed with passing php session data to the browser. When a user logs in, the session is created from php/login.php. This requires sending an HTTP post, which contains the user's entered password. There is probably a better way, but this works for now. If the username is found and the password is verified, the record for that user (except for the password hash) is sent back to the browser as a JSON object. In the demo you can see this in the console after logging in. I recently finished a database course, so in many ways I'd like to use some real data constraints. I find theory and practice don't align well here. I maintain the username uniqueness by simply not allowing a user to register with a name that already exist. I came up with a real time validation on the registration page. As a user types, if the value matches a username in the database the registration button doesn't enable. I know what you are thinking. James ... You're making it easy for the hackers to find out all your usernames! Yes that is true, but my response is "who cares?" Really, why should user names be private? There is a balance to be had between security and user friendly. Most website will not tell a user which is wrong between the username or password on a failed login attempt. The idea is a hacker won't know know if the username is valid. BUT anyone can find out if a username is there simply by trying to register that name. Now they know all their hackory is not wasted on an invalid username. Security should come from within the system. If a user fails to log in after so many attempts, red flags should be raised. A brute force attack can be thwarted with a 5 second lock out between attempts. Doesn't sound like much but when you have the hardware to brute force a billion passwords per minute and then limit it to 12 per minute... those guys will go somewhere else. A normal user will not even notice. That being said, there is no timer lock out on failed attempts in this demo (yet). That's my two cents on security. I plan to add more to this in the future. Feedback is appreciated, as always. :) Posted by James at 4:09 PM 21 comments: Unknown said... Omg, thank you very very very much!!! Im gonna use it 10:16 PM Data Analytics Course in Dehradun said... Really nice and interesting post. I was looking for this kind of information and enjoyed reading this one. Keep posting. Thanks for sharing. cyber security course in patna 12:15 AM business analytics course in chennai with placement said... Impressive. Your story always bring hope and new energy. Keep up the good work. Data Science Course in Chennai 10:03 PM business analytics course in chennai with placement said... Impressive. Your story always bring hope and new energy. Keep up the good work. Business Analytics Course in Vadodara 11:41 PM business analytics course in chennai with placement said... Very awesome!!! When I seek for this I found this website at the top of all blogs in search engine. Data Scientist Course in Chennai 10:35 PM jacqulinedcruz said... That's what I'm looking for no doubt you provide such useful information about development and Psychology Homework Help USA, I really appreciate your efforts. 6:36 AM business analytics course in chennai with placement said... I think about it is most required for making more on this get engaged Data Scientist Course in Dehradun 11:01 PM business analytics course in chennai with placement said... pleasant bLog! its fascinating. much obliged to you for sharing Business Analytics Course in Dombivli 9:25 PM business analytics course in chennai with placement said... Someone Sometimes with visits your blog regularly and recommended it in my experience to read as well.Data Science Course in Dombivli 11:41 PM business analytics course in chennai with placement said... I truly like you're composing style, incredible data, thankyou for posting.Data Scientist Course in Vadodara 11:18 PM business analytics course in chennai with placement said... Impressive. Your story always bring hope and new energy. Keep up the good work. Data Science Training in Chennai 12:08 AM business analytics course in chennai with placement said... Very awesome!!! When I seek for this I found this website at the top of all blogs in search engine. Data Analytics Course in Chennai 4:22 AM business analytics course in chennai with placement said... I think about it is most required for making more on this get engaged Business Analytics Course in Dehradun 11:08 PM Data Analytics Course in Dehradun said... There is obviously a lot to know about this. I think you made some good points in Features also. Keep working, great job! Data Science Training in Dehradun 9:46 PM business analytics course in chennai with placement said... pleasant bLog! its fascinating. much obliged to you for sharing. Business Analytics Course in Dombivli 11:17 PM business analytics course in chennai with placement said... Superb Information, I really appreciated with it, This is fine to read and valuable pro potential, I really bookmark it, pro broaden read. Appreciation pro sharing. I like it.Data Analytics Course in Dombivli 12:19 AM Data Analytics Course in Dehradun said... There is obviously a lot to know about this. I think you made some good points in Features also. Keep working, great job! Data Science Training in Dombivli 12:28 AM business analytics course in chennai with placement said... pleasant blog! its fascinating. much obliged to you for sharing Business Analytics Course in Dehradun 10:45 PM business analytics course in chennai with placement said... This is a wonderful article, Given so much info in it, These type of articles keeps the users interest in the website, and keep on sharing more ... good luck. Data Science Course in Dehradun 9:55 PM marketing essay writing service said... Without a doubt, that's what I'm looking for, and you offer such insightful information on growth and marketing, so I really appreciate your work. 7:38 AM Michael Wade said... Thank you for another amazing post make blog on business sustainability dissertation topics 5:07 AM Post a Comment Newer Post Older Post Home Subscribe to: Post Comments (Atom) Search This Blog James View my complete profile Blog Archive ► 2015 (4) ► June (1) ► April (1) ► March (1) ► January (1) ▼ 2014 (11) ▼ December (1) A Real Ajax Login System ► November (1) ► September (1) ► August (1) ► July (1) ► June (1) ► May (1) ► April (1) ► March (1) ► February (1) ► January (1) ► 2013 (11) ► December (2) ► October (1) ► September (1) ► August (1) ► May (2) ► April (1) ► March (1) ► February (1) ► January (1) ► 2012 (17) ► December (1) ► November (2) ► October (3) ► September (1) ► August (2) ► June (2) ► May (3) ► March (2) ► January (1) ► 2011 (11) ► December (1) ► November (3) ► October (2) ► September (4) ► August (1) ► 2010 (3) ► February (3) ► 2009 (5) ► April (1) ► February (3) ► January (1) ► 2008 (39) ► September (2) ► August (6) ► May (7) ► April (8) ► March (9) ► February (1) ► January (6) ► 2007 (43) ► December (2) ► November (6) ► October (3) ► September (5) ► August (6) ► July (14) ► June (5) ► January (2) ► 2006 (10) ► December (1) ► November (1) ► October (5) ► February (2) ► January (1) ► 2005 (40) ► October (1) ► September (2) ► August (6) ► July (5) ► June (3) ► May (13) ► April (10) ► 2004 (67) ► September (8) ► August (25) ► July (19) ► June (2) ► May (13) Powered by Blogger.