Questions tagged [authentication]

Authentication is the process of providing a proof of identity or verifying identity.

Authentication is the process of providing a proof of identity or verifying identity. This might involve confirming the identity of a person or software program, tracing the origins of an artifact, or ensuring that a product is what its packaging and labeling claims to be. Authentication is different than Authorization, which is the step of allowing access to a resource. Authentication and authorization usually happen together to verify identity and then allow access.

The first type of authentication is accepting proof of identity given by a credible person who has evidence on the said identity, or on the originator and the object under assessment as the originator's artifact respectively.

The second type of authentication is comparing the attributes of the object itself to what is known about objects of that origin. For example, an art expert might look for similarities in the style of painting, check the location and form of a signature, or compare the object to an old photograph.

The third type of authentication relies on documentation or other external affirmations.

Factors and identity

The ways in which someone may be authenticated fall into three categories, based on what is known as the factors of authentication: something the user knows, something the user has, and something the user is. Each authentication factor covers a range of elements used to authenticate or verify a person's identity prior to being granted access, approving a transaction request, signing a document or other work product, granting authority to others, and establishing a chain of authority.

74922 questions
154
votes
13 answers

Should I hash the password before sending it to the server side?

I noticed that most sites send the passwords as plain text over HTTPS to the server. Is there any advantage if instead of that I sent the hash of the password to the server? Would it be more secure?
Jader Dias
  • 88,211
  • 155
  • 421
  • 625
147
votes
2 answers

Change GitHub Account username

I want to change my account's user name on GitHub, but I can't find how to do it. Is this possible at all? To clarify, I'm not talking about the user.name parameter in a git repository, but the username of the actual GitHub account.
Aleksandar Savkov
  • 2,894
  • 3
  • 24
  • 30
147
votes
2 answers

How to use Python to login to a webpage and retrieve cookies for later usage?

I want to download and parse webpage using python, but to access it I need a couple of cookies set. Therefore I need to login over https to the webpage first. The login moment involves sending two POST params (username, password) to /login.php.…
mandom
  • 1,481
  • 3
  • 10
  • 5
146
votes
7 answers

Angular redirect to login page

I come from the Asp.Net MVC world where users trying to access a page they are not authorized are automatically redirected to the login page. I am trying to reproduce this behavior on Angular. I came accross the @CanActivate decorator, but it…
Amaury
  • 1,623
  • 2
  • 11
  • 7
142
votes
7 answers

Anti-forgery token issues

I am having an issue with the anti-forgery token :( I have created my own User class which worked fine but now I am getting an error whenever I go to the /Account/Register page. The error is: A claim of…
r3plica
  • 13,017
  • 23
  • 128
  • 290
141
votes
2 answers

CSRF Token necessary when using Stateless(= Sessionless) Authentication?

Is it necessary to use CSRF Protection when the application relies on stateless authentication (using something like HMAC)? Example: We've got a single page app (otherwise we have to append the token on each link:
140
votes
7 answers

How do popular apps authenticate user requests from their mobile app to their server?

Say I have an Android application that connects to a .Net API for receiving/setting data. The confusion that I have is regarding how to sign-up/login the user first time and authenticate it every time they make a request to the API. If I just use…
Maven
  • 14,587
  • 42
  • 113
  • 174
136
votes
10 answers

nodejs - error self signed certificate in certificate chain

I am facing a problem with client side https requests. A snippet can look like this: var fs = require('fs'); var https = require('https'); var options = { hostname: 'someHostName.com', port: 443, path: '/path', method: 'GET', …
kDoyle
  • 1,487
  • 2
  • 9
  • 7
136
votes
11 answers

SHA1 vs md5 vs SHA256: which to use for a PHP login?

I'm making a php login, and I'm trying to decide whether to use SHA1 or Md5, or SHA256 which I read about in another stackoverflow article. Are any of them more secure than others? For SHA1/256, do I still use a salt? Also, is this a secure way to…
Tony Stark
  • 24,588
  • 41
  • 96
  • 113
136
votes
24 answers

Laravel: Auth::user()->id trying to get a property of a non-object

I'm getting the following error "trying to get a property of a non-object" when I submit a form to add a user, the error is apparently on the first line: Auth::user()->id of the following: $id = Auth::user()->id; $currentuser =…
Josh
  • 5,999
  • 8
  • 30
  • 43
135
votes
5 answers

OpenID vs. OAuth

Possible Duplicate: What's the difference between OpenID and OAuth? What is really the difference between OpenID and oAuth? They look just the same to me. I should clarify, I'm planning to use them in drupal, if that makes any difference. So I…
loop
  • 1,407
  • 2
  • 10
  • 4
134
votes
7 answers

Socket.IO Authentication

I am trying to use Socket.IO in Node.js, and am trying to allow the server to give an identity to each of the Socket.IO clients. As the socket code is outside the scope of the http server code, it doesn't have easy access to the request information…
Ryan
  • 2,102
  • 4
  • 18
  • 23
134
votes
5 answers

RESTful Login Failure: Return 401 or Custom Response

This is a conceptual question. I have a client (mobile) application which needs to support a login action against a RESTful web service. Because the web service is RESTful, this amounts to the client accepting a username/password from the user,…
Matt
  • 1,996
  • 5
  • 18
  • 24
133
votes
7 answers

How to login and authenticate to Postgresql after a fresh install?

Did a new install of postgres 8.4 on mint ubuntu. How do I create a user for postgres and login using psql? When I type psql, it just tells me psql: FATAL: Ident authentication failed for user "my-ubuntu-username"
user61734
  • 2,813
  • 5
  • 25
  • 18
133
votes
12 answers

MVC 5 Access Claims Identity User Data

I am developing an MVC 5 web application using Entity Framework 5 Database First approach. I am using OWIN for the authentication of Users. Below shows my Login method within my Account Controller. public ActionResult Login(LoginViewModel model,…
tcode
  • 5,055
  • 19
  • 65
  • 124