My question(s) is/are:
If I put a form token (one random based, another time based), does that cover CSRF attacks?
- Would I have all my bases covered after all this? Would this form be secure?
Actually this could be a major security problem. The reason why passwords are hashed is a means of planning on failure. An attacker might gain access to the data store (sql injection) and then obtain the hash. If you are just logging in with a hash, then the attacker doesn’t have to crack the recovered hash in order to gain access to the application.
Replay attacksare also a problem. If I sniff the hash during authentication, whats stopping me from just replaying that request to authenticate?
Protocols that use message digest functions for authentication provide the client with a nonce, which is used as a one time salt. Microsoft’s SMB NTLM authentication is a good example, but it has had a lot of problems
USE SSL, and not just for login. OWASP A9
states that the session id must never be leaked over an insecure channel. After all who cares about the password if you just spill the real authentication credentials a few milliseconds later.
Most people don’t implement CSRF protection for login. After all the attacker would have to know the password in the first place, so “session riding” is a moot point.