Off the shelf PHP secure user authentication

[bubster119]

Does anybody know of a commercial user authentication script that I can just purchase and bolt on to my website.

I'm looking for something up to date with the latest security issues (password hashing) etc.

I'm a designer by trade and am just looking for a script to secure the client access aspect of my portfolio site.

Any information would be greatly appreciated

Cheers

[The Contractor]

Well this may or may not help, but I find it a very handy tool to create users and allow them into specific areas as long as you can use .htaccess files and your PC is using Windows. Nice little pice of software.

[freshsoftware.com...]

[edited by: jatar_k at 4:27 pm (utc) on Oct. 31, 2007]
[edit reason] linked it up [/edit]

[bubster119]

Thanks, I'm using .htaccess at the moment but apparently the passwords are pretty easily accessible to those with a little knowledge.

Thats why i'm looking in the php direction.

[The Contractor]

Not sure why they would be any more accessible than any other script. You need to make sure you hide your .htaccess files from view with the following in your main .htaccess file.

<Files .htaccess>
deny from all
</Files>

Passwords are encrypted after uploading with Warden (if you view the .htaccess file).

[bubster119]

I'm just going through the apache doc now, it states:

"Although the password is stored on the server in encrypted format, it is passed from the client to the server in plain text across the network. Anyone listening with any variety of packet sniffer will be able to read the username and password in the clear as it goes across."

?

[The Contractor]

But how would that change with any other script? Call it via SSL then...as you would have the same problem with anything.

[bubster119]

Good point. It's certainly an option.