I'm currently writing my dissertation about web security. I am focussing on the use of authentication libraries in web applications. As part of this I am writing a library for CodeIgniter with the aim of providing a single-sign-on type of authentication by implementing support for a number of OAuth providers.
My questions to you, the community are as follows:
- What makes a good authentication library?
- How should it be structured and to what extent should it abstract the auth process?
- What factors would influence your decission to choose one library over another?
So far, my considerations to this have been about speed, simplicity of the code, simplicity of implementation for the app developer and most importantly the actual security of the product.
Any feedback would be highly valued. Many Thanks.