Comments (12)
Hello,
The Resonant Core website is now defunct. However, the same advice is alive and well here: https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#title.2
Regards,
Scott
from aura.auth.
Yes this is really an interesting functionality. Also deals with security.
from aura.auth.
Yeah, and thinking about it makes me re-think some of this very early work (only a few days old!).
from aura.auth.
Isn't "remember me" just basically an extension of the length of the session? Shouldn't the auth/session handler just be able to set a time far out in the future when "remember me" is enabled?
from aura.auth.
No, there's something about setting a special cookie that can re-enable a session without actually logging in. However, the safest variations of these compare the cookie value with a value stored elsewhere.
from aura.auth.
Yeah, it'd almost have to be some kind of adapter behind it for the storage, similar to how the other adapters are used (defaulting to PDO I imagine).
from aura.auth.
Yes, session timeout is different. As @pmjones mentioned, you need some special cookie value stored, and recheck that on next login. On every new login we should reset the cookie with a different value.
Recently I was able to implement something for processwire. Somethings we need to do are
- If the user is logged in via remember me, don't let them reset the password and don't give some sort of administrative privileges.
- Reset hash on every request.
- Good to keep a hash in db rather than the same value stored in cookie.
- Need to limit the amount of login request
from aura.auth.
Hi Paul,
I wonder when creating a remember me cookie we are trying to duplicate some of the code of Aura.Session . Else we may need to use the same function session_set_cookie_params
to increase the cookie time.
$session->setCookieParams(array('lifetime' => '3600'));
The more I am thinking, I have a feeling we should add aura/session
as a dependency to Aura.Auth for easy usage. I am not caring how others think about Auth. But the ease of use should be thought than splitting more.
Or we may need to define a shared interface, and don't implement the functionality but suggest to use the aura/session
which is already implemented to work for it.
Thanks!
from aura.auth.
I think, if anything, the "remember me" functionality should allow for different storage methods with Aura.Session being the default. I know the project is all about reducing dependencies, but in this case I think it's necessary from a DRY perspective.
from aura.auth.
I just implemented something like this it basically worked like this...
- Create cookie with randomly generated key with extended lifetime (leaving php session cookie alone, with standard lifetime)
- On return to site if session has expired cookie key was looked up in redis storage. The redis storage would return a user identifier which is then used to create a new session for that user.
- Logout of course destroys both the session and the remember me cookie
Few notes, storage is the key part here as you need to secure this part. So memcached, redis, db or file storage should all be options. Any key value store really. Any access to this data will mean complete site compromise. So encryption layer might be useful.
The cookie can easily be stolen, ways to reduce damage include regenerating the cookie key everytime the session expires. Ensuring the cookie is httponly and https. Useragent checking to ensure useragent has not changed (may not always be reliable, upgrades etc).
from aura.auth.
great points @jleckie .
from aura.auth.
For future reference: https://resonantcore.net/blog/2015/02/remember-me-safely-secure-long-term-authentication-strategies
from aura.auth.
Related Issues (20)
- 4.0.0 Release? HOT 2
- PHP 7.4 compatibility HOT 3
- Add ldap bind user HOT 13
- Release and without fear to use HOT 1
- PDO: Thrown exception error messages HOT 6
- Auth object calling session_start HOT 1
- Rehash HOT 2
- Does HtpasswordVerifier need to verify the password hash is buggy and using bcrypt ? HOT 1
- Better ways to handle brute force attack
- Sessions, remember me functionality and other things. HOT 1
- Can't use minimum-stability: stable with this package HOT 2
- Adapter in resume HOT 1
- Probably good to have messages passed for Exceptions ? HOT 3
- LdapAdapter::bind performs a double unbind on the underlying ldap resource HOT 2
- Default timeout values HOT 3
- Missing return values, or changed API and docblock out of date? HOT 4
- Aura.Session compatibility HOT 12
- Unable to logout HOT 1
- If password changes, session is still valid. HOT 4
- New release builds, please? HOT 14
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aura.auth.