Auth

Authentication and Authorization

Authentication

• Signing in
• Signing Out
• Verifying the password a user entered on the login form

Types of Authentication

• Form-based
  • A username and password are stored in a database
• OAuth
  • The user signs in with their Facebook, Google, Github, etc. account
• Single Signon
  • One Login and other Enterprise systems

Registration/Signing Up

1. The user enters a username and password
   • email=kim@example.com&password=password
2. POST request is sent with the data
3. The program checks to see whether or not the username is in use
4. The program hashes the password
5. The program stores the username and hashed password in the DB

Signing In

1. The user enters their username and password
   • email=kim@example.com&password=password
2. POST request is sent with the data
3. The password the user entered is hashed
4. The username and hashed password are compared to what is stored in the DB
5. A cookie is set
6. RBAC

Hashing

• A salt is a long, random string of bytes that gets added to a password before it is hashed
  • The idea is to make a brute force attack less likely (?)
• Old-school approaches meant one salt per DB
• Newer approaches have per-user salts

Bcrypt

• Bcrypt has designed to create password hashes
• It takes 100ms to computer (in 2012, anyway)
• It is SLOW on purpose. 10,000 times slower than sha1()