13

I have to implement login tokens in my Lithium (the PHP framework) based application. Two reasons:

I want to have a "remember me" function.

I also need a way of tracking logins on the server so that I can verify authenticated users on a node.js socket server like so:

  1. User requests a page
  2. Server returns a view with a session token somewhere in the HTML
  3. The client side JS reads the token and send it to the node.js server in an attempt to establish a connection via web sockets.
  4. The server receives the connect request and verifies the token sent to it with the PHP server.
  5. Allows or denies a connection based on the result.

So this is a two part question, and it's just to verify that I'm not being an idiot because the security on this site is of higher priority than usual.

Is this a reasonable way of creating a login token?

<?php
// String::hash() generates a sha512 (by default) hash. 
String::hash(time() . $user['username']);
?>

Is the web socket authentication system I proposed sane? Can you see any problems arising or any more efficient ways of doing it?

rich97
  • 2,809
  • 2
  • 28
  • 34
  • 3
    Why not include the user's password in the making of the hash? If you only use the time and username, anyone who knows the time that the user requested the page and the user's username will be able to get the hash as well. – EdoDodo Jul 04 '11 at 10:53
  • I would also add session ID when generating the token. – Aleks G Jul 04 '11 at 10:58
  • Or anyone who knows just the user name could brute-combine it with timestamps to fake a token. – Lisa Jul 04 '11 at 10:58
  • please look at OpenID => http://www.codinghorror.com/blog/2008/05/openid-does-the-world-really-need-yet-another-username-and-password.html – Alfred Jul 04 '11 at 15:14
  • @Alfred As much as I agree I don't have time for that right now, will put it on the TODO. – rich97 Jul 04 '11 at 15:51
  • @Rich97 instead of costing time, it will save you time. There are some really friendly openID libraries available. Let's take for example LightOpenID just works. I have a demo available at http://westerveld.name/php-openid/ which also has friendly openid selector. You can view/download the source at https://github.com/alfredwesterveld/php-openid – Alfred Jul 04 '11 at 16:04

3 Answers3

6

First, you should change the way your login token is generated. A hash of the current time concatenated with the username is far from being difficult to guess; which is a necessary condition for it to be secure. There are many ways to do this, what's crucial is that you use a good source of randomness. You could do:

list(,$token) = unpack('H*', openssl_random_pseudo_bytes(15, $safe));
$safe or die("unsafe source");

The overall method you're using is only secure if you the bearer token you're passing around is never sent unencrypted. This means every time it is transmitted it must be transmitted over SSL/TLS.

There's still the problem that you may accidentally send the token to the wrong place, so you must be extra careful if any destination is somehow dynamically generated (e.g. through some discovery protocol). The only way to avoid this problem would be to use cryptography.

Artefacto
  • 96,375
  • 17
  • 202
  • 225
5

You should look at the RequestToken class in Lithium: http://li3.me/docs/lithium/security/validation/RequestToken::check()#source

It handles CSRF protection, and uses cryptographically secure random tokens, based on principles similar to the above, but with an extra layer of protection with bcrypt, which can match any number of unique hashes.

botero
  • 598
  • 2
  • 11
  • 23
Nate Abele
  • 5,771
  • 32
  • 27
2

You could use the uniqid() function to generate a unique ID, to increase your security, and then you can drop or use together with the time.

<?php
String::hash(time() . uniqid() . $user['username']);
?>
Guilherme Quental
  • 63
  • 5