Questions tagged [authentication]

Authentication is commonly understood as the act of asserting a user's or entity's identity, although in the wider sense it can refer to asserting the truthfulness of any kind of claim. Authentication, like encryption, is a major component in implementing computer security.

Filter by
Sorted by
Tagged with
11
votes
4answers
1k views

Does SSL really matter for most websites?

I've been pretty paranoid about learning to "do security right" for this site I'm building (first non-trivial site I've made), and I've noticed something that bothers me: SSL. I've read plenty of ...
9
votes
3answers
19k views

Can I create test accounts in Google for testing Oauth in my application?

My app contains Sign in from Google function that uses Oauth. To test it I'd want to create test accounts at Google. But Google doesn't allow me to create ordinary accounts without entering captcha so ...
8
votes
8answers
580 views

What are the reasons to have a two step login? (Username on one page, password on the second.)

So I've recently been encountering more two step login processes, where I'm required to enter my username on one page and my password on a second. I really don't like this pattern, as it requires an ...
8
votes
5answers
50k views

How to login as another user in phpmyadmin

I installed phpmyadmin in Win7, and if I type http://localhost/phpmyadmin/index.php in the browser, it will log in phpmyadmin as root user by default. I created a new user but still there's no login ...
8
votes
2answers
499 views

Should I support facebook login or openid login?

What are the pros and cons of each? Does it make any sense supporting both? Which is easier for users/to implement?
8
votes
2answers
8k views

More Secure NGINX Authentication than auth_basic

I've been trying to come up with the most secure method of authentication to my reverse proxy in NGINX. I've been using ngx_http_auth_basic_module so far without any issues, but there are apparently ...
8
votes
2answers
138 views

What do I lose if I use OpenID instead of the custom login system I built

I'm trying to make the decision whether to use OpenID or stay with a well-built custom login system. I think the appeal of OpenID is clear, in that the user doesn't have to create yet another account ...
8
votes
4answers
251 views

How should a site respond to automated login attempts with phony usernames?

For the last couple weeks I've been seeing a consistent stream of 15-30 invalid login attempts per hours on my site. Many of them are non-sensical usernames that nobody would ever register for real, ...
8
votes
4answers
2k views

Is it generally a good idea to allow the reuse of old usernames from deleted accounts?

On a Social Networking site, is it generally a good idea to allow the reuse of old usernames from deleted accounts, or is it better to prohibit their reuse forever? How do the big boys do it (...
8
votes
1answer
920 views

Permissions for serving up temporary files

I have a system (web based application) which pulls file attachments from a 3rd party system via SOAP. These are in turn on our system created as files in a directory. When a user of the system (...
8
votes
1answer
354 views

What do I need to do to make my site compatible with Safari's iCloud Keychain so that it saves passwords?

I've noticed that a vendor's web application triggers Safari's "suggested password" feature at "create password" forms, but does not actually save this password when the form is submitted. That is, ...
8
votes
0answers
179 views

Automatic reauthenticate at oauth2 endpoint

I am currently (ab)using an oauth2 endpoint of an API to enable users of the API to login to my site (using response_type=code). I do not save refresh tokens or even access_token as that oauth2 ...
7
votes
2answers
3k views

How can I secure an installation of MediaWiki?

I want to run an installation of MediaWiki as a Internet-accessible personal wiki, running on wiki.mysite.com. However, I want to ensure that I am the only one who can read and write to this wiki. In ...
7
votes
4answers
1k views

How do you get Drupal to go to a page other than the User Profile on login?

ISSUE: I've tried a few things to get Drupal to STOP going to the User Prolfile page on login. I even installed the LoginToboggan module, which has nice features, just doesn't stop Drupal from sending ...
7
votes
4answers
295 views

Single Sign on across Websites

I have three different websites that I run on three distinct top level domains. I would like to be able to have users log into any one of them and then be automatically logged into all three. As an ...
7
votes
2answers
4k views

How to use cookies in a secure manner to authenticate users?

In most cases I like using cookies to remember returning users to my websites. In my early/foolish days, I would store a UserID (auto-increment integer) in a cookie and if the user returned I would ...
6
votes
5answers
166 views

Allowing users to post without logging in

On Stackoverflow/Stackexchange, users are allowed to add posts without requiring login, just wondering what should be considered before allowing this kind behavior on a site? Couple of things spring ...
6
votes
3answers
412 views

Using two salts for user authentication?

When storing user credentials in a database, we all know that hashing the password is the bare minimum you should do, but salting it before hashing is better. The salt should be randomly generated, ...
6
votes
3answers
635 views

When should you consider being an OpenID provider?

I know that OpenID would benefit more from a larger number of sites adopting it, than it would from more people being providers. But even still, I am curious as to when it would be good for a site to ...
6
votes
1answer
2k views

Does htpasswd authentication prevent Google from crawling my site?

I have a site that I want to continue testing before I make public, so I don't want Google to start crawling the site as there will be a large amount of garbage content during testing. I currently ...
6
votes
2answers
529 views

HTTP for one part of the site, HTTPS for other

We have a site which is HTTP, but it has an admin part. How can we secure the admin part with HTTPS? For example, WordPress (which I know) is located at http://foo.com, but we want to have https://...
6
votes
2answers
239 views

Managing accounts on a private website for a real-life community

I'm looking at setting-up a walled-in (i.e. mostly private, with a small public-facing login page) website for a real-life community of people, and I was wondering if anyone has any experience with ...
6
votes
1answer
56 views

Can't login or edit on 3 wordpress sites from a particular Windows PC

I have 3 wordpress.org sites and I have problems logging in and/or editing all three from one particular laptop (Win 7 Home Premium). It is puzzling. I can load regular pages from the sites OK. The ...
6
votes
5answers
117 views

How to include content from remote server while keeping that content secure

I am hosting collection of videos, for which I retain the copyright, on a file server that I'd like to share with family and friends. When a user visits my file server via a web browser they are ...
5
votes
2answers
2k views

CDN for authenticated sites

We have a site that requires users to sign into. Typical stuff. Today, all the content (dynamic and static) is behind the login process, and you cannot access any of the pages or files via a URL ...
5
votes
2answers
13k views

How to make browsers offer to remember passwords

What properties login form needs to have to trigger "remember password" for all (or most) browsers? Background: For years I have been using Opera, and the rule has been that almost anything that ...
5
votes
1answer
2k views

Are there any other login products similar to LoginRadius? [closed]

I'm thinking of using LoginRadius social site login/registration solution to integrate with traditional login/registration system. Has anyone ever used it and have any opinion about its performance ...
5
votes
2answers
1k views

How do I setup authentication on a specific folder using .htaccess?

I have a folder that I want to host files privately on my webserver. How do I go about making it password protected using .htaccess? Note: Nothing monolithic, I want something that is simple/easy so ...
5
votes
2answers
803 views

Combining a content management system with ASP.NET

I am going to be creating a site that seems like it requires a blend of a content management system (CMS) and some custom web development (which is done in ASP.NET MVC). I have plenty of web ...
5
votes
1answer
2k views

Password protect an alias virtual directory

I have a main domain being hosted through CPanel. I also have a sub-domain that I would like to appear as a path under the main domain instead of as a sub-domain. So I have: http://example.com/ ...
4
votes
5answers
3k views

Do user names used for login need to be unique?

Assuming a non-commercial site where users login with a user name and pw, do I need to enforce unicity of usernames? Note: The db will use a separate unique index to identify the users. The site is ...
4
votes
5answers
2k views

How to you prevent someone from getting a “new free trial period” by just creating a new login?

I am considering several options for the Trial version of our web app. The one I favor the most is the classic trial period. Of course, it's a LOT easier for someone to hack this system. They can ...
4
votes
3answers
2k views

How to allow Google to index protected content?

I'm working on my site and as it require users to log in it will be hard to Google to index the sites, because to see 90% of the content you have to be online. So I've made a script which looks for ...
4
votes
2answers
195 views

Why do user registration process not end with the user logged in?

Often I see websites when at the end of the registration process the user is not logged in. What is the rational for that? It seems redundant to ask a user to reenter their credentials just after ...
4
votes
3answers
544 views

How useful is Facebook Connect Login?

I'm starting to see some Websites offer the option to login via Facebook. I'm curious how useful it is a feature. For example, when someone logs in, does her friend knows on Facebook that she logged ...
4
votes
2answers
784 views

Should I track the login page?

I've recently started using Google Analytics on a B2B ecommerce site with authentication. Users must login and are redirected to the login page if they try to access an internal page without first ...
4
votes
2answers
216 views

Will using HTTPS hurt my site's SEO or other statistics?

I've set up a WordPress blog. Since I have to log into it from many different locations/machines, I've also got an SSL certificate, and set up Apache to redirect HTTP to HTTPS. It all works, but I'm ...
4
votes
1answer
74 views

Does the presence of a flash banner on a site inherently create a vulnerability on the site?

Does the presence of a flash banner inherently open the site up to exploits, or is there a way to ensure the flash banner does not have "access" to anything important on the page. The page in ...
4
votes
2answers
513 views

SEO Impact on presenting User details without login

I am looking to develop a functionality on our website in which i can a show user their name based on cookie data. There will be no login required. we will retrieve user's name based on the previous ...
4
votes
2answers
526 views

Facebook connect vs. OpenID

I just started working on a new project that has a general login feature. One suggestion in a meeting was to look into Facebook Connect or OpenID as an alternative. I'm curious if there's one that has ...
4
votes
1answer
785 views

How to allow MediaWiki non-users to only read some wiki pages related login and account creation?

I've created a BlueSpice MediaWiki site that I only want visible to users that are logged in. This works fine by creating Read permission only for Users as described here. All this works fine until ...
4
votes
3answers
1k views

Different authentication for HTTP POST and GET requests in Apache

I want to authenticate for POST requests for http://path/to/logical/abc.xml (but not GET requests to that URL). How do I put constraints like this in place? The paths are logical and location ...
4
votes
1answer
136 views

How to determine the sequence of ordering certificates by browser?

I did a Mutual Certificate Authentication implementation with OpenSSL and Apache Web Server on CentOS platform. To simple explanation see this diagram: ---------- | ...
4
votes
2answers
281 views

How do I edit/modify a file on a webserver using php file in the same location? [closed]

I have an XML file on my server. In the same directory I have a PHP file which modifies the content of the XML and saves it. In this, the save part doesn't work. In my knowledge the code is alright ...
3
votes
2answers
322 views

How to maintain unique user per paid account in a website with given set of Email ID and password?

For a website, there is a free and a paid membership option. Once the user pays some amount he gets a membership for a month for additional products that are not in the free account on the website. ...
3
votes
3answers
235 views

Which social sign-in (Google, twitter, fb, etc) is most often used (if I could only choose one, which would statistically retain the most users)?

I am working with a startup which is about to do its launch in maybe 2-3 weeks. In order to see the primary features of the site, the user has to register or sign in if they have already registered. ...
3
votes
2answers
2k views

OpenID, Gmail, Facebook, Yahoo login for Wordpress

Is there somethink like this for free for wordpress?
3
votes
1answer
147 views

Does requiring login to access content hinder SEO?

I am wondering what the SEO effects of a 'Login Wall' is. More specifically, we have content that is region specific, so for instance a URL could look like www.example.com/content/Canada/Ontario. This ...
3
votes
1answer
2k views

Does Orchard have Active Directory authentication?

I've been looking over the Orchard CMS and it seems like a capable CMS and mature enough to do what we need here. However, one thing I haven't been able to find info on is AD authentication. We plan ...
3
votes
1answer
2k views

How to implement OpenID authentication for my site?

I want to offer OpenID authentication for my users (please note that I do not necessary want to become an OpenID provider; I just need to authenticate my user for my website). How to implement OpenID ...