Case study · 2024
Secure Authentication System
Built to understand what a properly secured auth flow actually requires — not what the tutorials skip.
- Role
- Sole developer
- Context
- Academic project, Richfield Graduate Institute of Technology
- Stack
- PHP, MySQL
- Focus
- OWASP practices applied end to end
Why build this
Most tutorial authentication systems store passwords badly, treat validation as a frontend concern, and ignore CSRF entirely. I wanted a reference implementation I'd actually written myself and could reason about properly.
What it defends against
- Password compromise — hashed with bcrypt via
password_hash(), never stored in plain text - SQL injection — prepared statements with bound parameters throughout
- Cross-site scripting — all output escaped before rendering
- CSRF — per-session tokens validated on every state-changing request
- Session hijacking — session ID regenerated on login, secure and HttpOnly flags set
The thing worth understanding
Client-side validation is user experience. It is not security. Anyone can bypass it with the browser console.
Every input in this system is validated server-side regardless of what the client sends. That's the only validation that counts, and it's the distinction that took me longest to internalise properly.
What I'd add next
- Rate limiting on login attempts to blunt brute-force
- Email verification at registration
- Password reset with time-limited, single-use tokens
- Two-factor authentication
Back to all case studies, or start a conversation.