Der findes et javascript til at lave md5 (og SHA1) hashing på client siden, det gør det nogenlunde sikkert.
javascriptet kan hentes her:
http://pajhome.org.uk/crypt/md5/Jeg er selv igang med at lave php authentication program, men er lidt usikker på om det er beskyttet overfor "replay" angreb. Koden kommer herunder, jeg vil gerne have kommentarer til sikkerheden, specielt mht. random og om den hjælper på sikkerheden.
<?php
require_once("StaticDB.php");
class MD5Login{
var $db;
function MD5Login(){
$this->db =& new StaticDB("host", "user", "password", "db");
session_start();
session_register('login');
session_register('password');
session_register('random');
if ( isset($_SESSION['random']) && isset($_SESSION['password']) && isset($_SESSION['login'])) {
$this->authenticateSession( $_SESSION['login'], $_SESSION['password'], $_SESSION['random'] );
}
else{
if( isset($_POST['password']) && $_POST['password'] != '' && isset($_POST['login']) && isset($_POST['random']) ){
$this->authenticatePost($_POST['login'], $_POST['password'], $_POST['random']);
}
else{
$this->loginForm();
}
}
}
function authenticateSession($login, $password, $random ){
$dbpw = md5( $this->db->getOneResult("SELECT password FROM kunder WHERE login = '$login'") ."". $random );
if( $password == $dbpw ){
$_SESSION['random'] = mt_rand();
$_SESSION['password'] = md5( $this->db->getOneResult("SELECT password FROM kunder WHERE login = '$login'") ."". $_SESSION['random'] );
$this->loggedin();
}
else{
echo "Forkert session password";
$this->reloadself();
}
}
function authenticatePost($login, $password, $random ){
$dbpw = md5( $this->db->getOneResult("SELECT password FROM kunder WHERE login = '$login'") ."". $_SESSION['random'] );
if ( $random == md5($_SESSION['random']) ) {
if( $password == $dbpw ){
$_SESSION['login'] = $login;
$_SESSION['password'] = $password;
$this->reloadself();
}
else{
echo "Forkert posted password";
session_unregister('login');
session_unregister('password');
session_unregister('random');
$this->reloadself();
}
}
else{
echo "FEJL i post authentication";
$this->reloadself();
}
}
function loginForm(){
$_SESSION['random'] = mt_rand();
echo "
<html>
<head>
<script language=\"JavaScript\" src=\"../javascript/md5.js\"></script>
<script language=\"JavaScript\">
function onformsubmit() {
var f = document.forms[0];
if (!f) {
alert('incompatible browser');
return false;
}
f.password.value = calcMD5( f.password.value + \"\" + f.random.value );
f.random.value = calcMD5( f.random.value );
return true;
}
</SCRIPT>
</head>
<body><center>
<form onSubmit=\"return onformsubmit();\" NAME=\"logon\" METHOD=\"POST\" ACTION=" . $_SERVER['PHP_SELF'] . ">
<input TYPE=\"hidden\" NAME=\"random\" VALUE=\"" . $_SESSION['random'] . "\">
login:<input TYPE=\"TEXT\" NAME=\"login\"><BR>
password:<input TYPE=\"PASSWORD\" NAME=\"password\"><BR>
<input TYPE=\"Submit\" VALUE=\"Logon\">
</form>
</center>
</body></html>";
exit;
}
function reloadself() {
echo "<SCRIPT LANGUAGE=\"Javascript\">this.location = document.location;</script>";
}
function loggedin(){
echo "<SCRIPT>
function logout(){
window.open(\"Logout.php\")
this.location = document.location;
}
</SCRIPT>";
echo "Du er nu logged ind!! tilykke<BR>
vil du logge ud? <a HREF=\"java script: logout()\">Logud</a>";
}
}
new MD5Login();
?>
Ny bruger
Nybegynder
Opret
Preview
