search

FFX01 / randora_website

Website for Randora Framework
2 stars 0 forks source link

Login security via SSL/HTTPS #1

Open FFX01 opened 9 years ago

FFX01 commented 9 years ago

Though not an issue during development, it will be very important in the future that we use SSL/HTTPS to encrypt post requests for user login and registration as otherwise, user password data is sent via POST request as plain text in the form data in the request header.

The passwords in the db are hashed and secure, so the server doesn't know what the user passwords are, however anyone sniffing packets over a wifi network or man in the middle connection will be able to gain access to the user's password in plain text format. This is not good.

In short, when the site goes into production, we MUST use SSL/HTTPS.

Master-Foo commented 9 years ago

I'll be sure to have an ssl cert. It's pretty much standard procedure to generate one.