reading-notes

Readings: Authentication

Introduction

This reading explores the topic of authentication, focusing on securing passwords, basic authentication, and understanding OWASP authentication best practices.

Securing Passwords

Safely Hashing and Storing Passwords

To safely hash and store a password, I would:

  1. Use a secure hashing algorithm like bcrypt.
  2. Generate a unique salt for each password.
  3. Hash the password along with the salt using bcrypt’s hashing function.
  4. Store the hashed password and the salt securely in the database.

Bcrypt

Bcrypt is a password hashing function designed to be slow and computationally intensive, making it resistant to brute-force attacks. We use bcrypt to securely hash passwords before storing them in a database.

Basic Auth

Understanding Basic Authentication

Basic Authentication is a simple authentication scheme built into the HTTP protocol. In Basic Authentication, the client sends credentials (username and password) with each request. These credentials are included in the HTTP header with the Authorization field.

Properties in the Header of a Basic Auth Request

The Authorization header is necessary for Basic Auth requests. It contains the word “Basic” followed by a space and then the Base64-encoded string of username:password.

Encoding Username and Password

The username and password in Basic Auth are encoded using Base64 encoding before sending them over the network.

OWASP Auth Cheatsheet

Authentication Process

Authentication is the process of verifying the identity of a user. It typically involves presenting credentials (such as username and password) and validating them against stored credentials in a secure manner.

Error Messaging

In terms of error messaging, both HTTP and HTML responses should provide informative yet non-revealing messages. HTTP responses should use appropriate status codes (e.g., 401 for unauthorized access), while HTML responses should avoid leaking sensitive information.

Reflection

After reading about authentication, my goal is to implement secure authentication mechanisms in my projects using best practices such as password hashing and using HTTPS. I look forward to learning more about OAuth, JWT, and other advanced authentication techniques in the upcoming modules.