Skip to main content

How to keep a user logged in?

Hi everyone,
Let's prepare some Cookies this time...

I've been searching for a secure method for keeping a user logged in. You knew that's easy by keeping sessions in server side. Well, I'm not referring that scenario.

You must have seen many "remember me"s just like the one in the figure.


This time I'm gonna share some insights of remembering the user after he leaves the current session.

But, hey! Do you like Cookies ?
Well, I know that's an ambiguous question. Anyway we're going to prepare some Cookies and coffee. Nice combination, right? Actually coffee helps me to create Cookies, mentally.

One insane thing here is no one else will be able to taste your Cookies, but you. And that's a necessary thing for adding security to your system.

Let's start overflowing from the Stack


I noticed this discussion on Stackoverflow, which essentially gives you some kind of... i don know... pleasure!? But there is a possibility of leakage, I think. That's why this post.

Dive in


First things first, never believe in cookies unless it is perfectly validated. Because they are widely exposed: from kids to kittens and hackers to even terrible hackers. And therefore do not store personal information in cookies.

Keep a user logged in


Note: this method requires verification from experts.

 We're going to split the content of our cookie into 3 parts.
  • A unique property of user which must be possibly public. This property should not shed insights about anything else in your system. This is to improve the efficiency of our login system.
  • One token, say X.
  • One hash, say Y.
Thus now our Cookie take the form:
possibly_public_propery:X:Y
For the sake of simplicity, possibly_public_property be the email. It helps our system to quickly identify the user who is trying to login.

We also have a unique id for each user.

  • Generate a random token X of 128-256 bit, and save it for the user.
  • The hash function used should be a keyed one, like HMAC.
  • Y = hash ( email +  " : " + X )
  • Set the Cookie in the form of : email:X:Y

Validate your Cookie


You prepared your Cookies and saved. You must taste it before you use it - to confirm it is the same one you created.

The validation goes like this:
  • Receive the cookie in the variable cookie
  • Split it so as to use it as 3 varibles : email , X , Y .
  • Check hash ( email + " : " + X ) equal to Y .
  • Fetch the stored token using the email . and compare it with X .
  • Log the user in.




Labels:

Comments

Post a Comment

Popular posts from this blog

Talky Messenger Documentation & Setup

( Github ) Just created a chat app that runs in Node and Socket. the attempt was worthy. Talky is a messenger app built with Node, Express, Socket, Angular & Bootstrap. It's like a server-client structure. (But obviously not like the one we done at OS lab using shared memory). It has a broadcasting structure. Talky does not keep a log on chat. i.e., It doesn't have a memory or database. When we close the browser window, chat history is lost. There I also added a basic console, protected by a password, to send real-time notifications to active clients. The name 'Talky' was suggested by a friend of mine. (hey, thank you for that. The fact is that I am not really good at naming...😝) What if sometimes your college blocks WhatsApp? Try Talky. ( There is also a website on internet in the name of 'Talky' which has no connection with this one. ) Download Talky Messenger To use Talky, all you need is 3 things: Node server Source code...
2 comments
Read more

Connecting Kerala's Call of Duty Warzone Community: Find Your Squad!

Namaskaram f ellow Warzone fanatics! Tired of dropping into Verdansk only to be met with a chorus of confused comms and random grenades? I feel your pain. Finding a squad that speaks your language (literally and figuratively) can be tougher than surviving a gas zone with only a pistol. That's why I've built this little corner of the internet – a rallying point for all the Malayalam-speaking Warzone warriors of Kerala! warzonekerala.com Why Join the Kerala Warzone Group? (More Than Just a Game): Let's face it, Warzone isn't just about shooting and looting. It's about camaraderie, shared victories, and the glorious "poda mone dinesha" moments. Here's why joining our community is a game-changer: Bhasha Bliss: Finally, a squad where you can strategize in crystal-clear Malayalam! No more frantic hand gestures or Google Translate mishaps. Coordinate drops, call out enemies, and celebrate wins in your mother tongue. Kerala Connection: Connect with ...
Post a Comment
Read more

How to install Node.js

Installing Node in Windows Installing node in Windows is pretty easy. To install Node you should be aware of your Windows bit version(32-bit / 64-bit). To know that, right click 'computer'>Properties. There you will find the bit version of the OS you are using. Now you know about the version of the OS you are using. - Head to nodes official website ( nodejs.org ) and download the msi for your version. - I recommend opting the LTS version of node. (if you have any suggestions, let me know.) - Install node with default recommended configuration. Installing Node in Linux/ Ubuntu This article will help you :  https://nodejs.org/en/download/package-manager/ If you don't have curl in your system, use terminal to: sudo apt-get update sudo apt-get install curl Source:  http://askubuntu.com/questions/259681/the-program-curl-is-currently-not-installed
Post a Comment
Read more