User Authentication Overview | Advanced PHP for Web Professionals

If you've ever built a Web site that requires user registration, then you have some idea of what is required to restrict access so that you can be sure the user who is registered is the same user who is currently accessing the site. In almost all cases, you must require the user to enter some sort of login and password to gain access to the site.

The current trend in site registration seems to be to require the users to enter their email as part of the registration process, and then subsequently send the users' password to them using that email address. This provides a number of benefits. First, you have the user's email and you know it is at least semivalid, since the user cannot gain access to the site without first submitting an email address and being sent a password. If users forget their passwords, you can easily send it to them (or a hint, if you require one) using some simple code. Additionally, you are able to send updates to users about site features, special events, etc., and you know the updates are going to valid addresses. On a side note, if you do send email to users, you should always ask their permission first in an open "opt-in" method. Additionally, you should provide an automated way for users to unsubscribe by clicking a link in the email you do send. Spam is a problem; let's not contribute to this ever-worsening problem.

Another advantage of requiring an email address is the ability to use it as the user's login. Email addresses must be unique, and only the valid holder of the email is able to receive any passwords that you send. This solves the problem of unique logins for every user. You do not have to write error-checking into your code that suggests alternative login names should one already be taken.

These authentication methods are for casual sites. They should not be used to protect sensitive information, such as social security numbers, credit card numbers, or anything that you wouldn't leave sitting on the street corner. There are ways to get around these methods, be it from hacking, IP spoofing, or good old brute force. However, these methods do work well for community sites where basic authentication is required and there is little to gain from spending hours upon hours in cracking attempts. A malicous hacker has lots to gain when credit cards are on the line, but when the reward is only a user's list of favorite links, there is little incentive to spend the effort required to crack a system. Simply put, don't assume that your information is safe by placing it solely behind a PHP authentication solution.

This chapter goes in depth into some of the above scenarios, as well as some additional ones, such as restricting logins to one domain or even a range of IP addresses.

Top