[eluser]tdktank59[/eluser]
Just found this. I like this guys ideas So with the below being said. I think im going to be doing a bit of revamping already lol... It would be nice to shave off DMZ however still leave the option there to use it... (Don't know if this will be easy or not...)
Quote:Authentication for CodeIgniter done right
Here's my MINIMAL required list of features from an authentication library. It also happens to be a subset of my own library's feature list 
1. Tiny footprint with optional test implementation
2. Full documentation
3. No autoloading required. Just-in-time loading of libraries for performance
4. Language file support; no hard-coded strings
5. reCAPTCHA supported but optional
6. Recommended TRUE random salt generation (e.g. using random.org or random.irb.hr)
7. Optional add-ons to support 3rd party login (OpenID, Facebook Connect, Google Account, etc.)
8. Login using either username or email
9. Separation of user and profile data
10. Emails for activation and lost passwords
11. Automatic cookie login feature
12. Configurable phpass for hashing (properly salted of course!)
13. Hashing of passwords
14. Hashing of autologin codes
15. Hashing of lost password codes
16. Hooks into CI's validation system
17. NO security questions!
18. Enforced strong password policy server-side, with optional client-side (Javascript) validator
19. Enforced maximum number of failed login attempts with BEST PRACTICES countermeasures against both dictionary and DoS attacks!
20. All database access done through prepared (bound) statements
Source:
http://stackoverflow.com/questions/34698...902#476902
