Authentication storage.
WHAT TO NEVER DO
Store passwords in readable form Use general-purpose hashing Write your own scheme Place a limit on length Restrict which characters are allowed
WHY GENERAL-PURPOSE HASHING FAILS
It is designed to be fast, which is exactly wrong for passwords.
WHAT TO USE
PHP's built-in password hashing, which uses an algorithm designed for the purpose.
WHAT IT HANDLES
Generating a unique salt Choosing the algorithm Verifying a supplied password Indicating when a stored hash should be updated
WHAT TO DO ON VERIFICATION
Check whether rehashing is needed, and update if so.
WHAT ELSE TO IMPLEMENT
Rate limiting on attempts A second authentication step, where warranted Ending sessions when a password changes
WHAT TO NEVER LOG
Passwords, in any form, including failed attempts.
WHAT TO DO ON RESET
Issue a single-use token with a short expiry Invalidate it once used Never send the password itself
WHAT TO REVEAL ON FAILURE
Nothing about which part was wrong.
