Redux Authentication 1.4a (24th July 2008)

[eluser]Popcorn[/eluser]
Thanks for your concern Sceneshift.

Well, since you are using your own login functions I will guide you on the 'login' logic.

A user will provide both an email address and a password, the method will then look up the email address and grab some data from the users table (hash, password, etc ...)

Both passwords will be hashed and then checked against each other, if they match then the users_id is set in the session.

The user_id is then used to identify the visitor, if the user_id exists, we assume they're logged in. From here we can check what group they're part of, etc ...

My advice to you would be to enable browser and ip checking in the CodeIgniter config.

Making Redux More Secure

Redux Authentication at the moment does not incorperate a database session library so information is stored on the clients machine. However, we assume some clients will hack the cookie and gain access like you suggested. You will need to use a drop in session replacement if you want to up the security.

http://codeigniter.com/wiki/KNDB_Session/
http://codeigniter.com/wiki/DB_Session/
http://codeigniter.com/wiki/DB2_Session/
http://codeigniter.com/wiki/NG_Session/
http://codeigniter.com/wiki/OB_Session/

These will take the information from the clients machine and store it in the database.

I've not decided if I should include a session library with Redux Authentication yet. Your views are appreciated, but I highly suggest anyone using this in a commercial environment to use a database session library.



Kind Regards,
-Mathew