Forum Moderators: open

Message Too Old, No Replies

Theory

Creating a password gateway

         

Adam5000

3:27 pm on Sep 16, 2010 (gmt 0)

10+ Year Member



I'm trying to create what I'm calling a password gateway for my website. It's the part where a user must register before continuing. A form pops up that says something like "Choose a username, choose a password, reenter password, enter email address" and possibly other fields.

I've captured the user input with a form via

<script type="text/javascript">

function username()
{
var a = getElementById('username')
var b = getElementById('password')
}

</script>

<form>
<input type="text" id="username">
<input type="text" id="password">
<input type="button" onClick="username()">
</form>

</script>

And I'm trying to figure out a way to verify the user when the user returns.

How is this usually done?

Right now I'm thinking add code to the function above and have it create a new folder on the server titled whatever username the user has chosen, and then put the password inside it.

Then when the user comes back, present a form that asks for the username and password.

Finally, have a function that checks the folder titles to see if the folder exists, and if it does then compare the password inside with the password the user has entered to see if they match.

What solution do most people use?

Help!

lammert

2:36 am on Sep 17, 2010 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Using folders with password information which may be accessible from the outside world doesn't seem a good idea to me. Many people use the same password on several online plaforms and you may put their webpresence at risk with this approach.

A better alternative would be to use a database where the password is stored after it has been encrypted with a one-way hashing function like MD5. A hacker who has access to that data can't decode the hashed strings to the original password, but it is possible to compare an entered password with the stored version by encrypting the password the user entered before the comparison with the hash.

Adam5000

6:44 pm on Sep 17, 2010 (gmt 0)

10+ Year Member



lammert. That sounds like a better idea. Store the passwords in encrypted form. And then, even if the database is compromised, no information is disclosed because the encoding is one way.

Cool idea.

Applause and cheers to you!