Codeigniter security - mysql database

Question

I'm in the final stages of implementing a CodeIgniter site which requires a really simple login system. One user, and one password to protect the admin area. I think I will be using one of the many CodeIgniter authentication libraries, which should allow me to ensure that people can't read from the database without being logged in as admin (hopefully).

Are there any glaring holes in a setup like this?
Should I take further measures beyond using a library like this to ensure the security of the data in the MySQL database?

It will be hosted on a shared server; meaning little, or no server config will be possible.

score 2 · Accepted Answer · edited Dec 08 '21 at 08:40

2

There is a long discussion about the authentication systems available here: How should I choose an authentication library for CodeIgniter?

The latest version of Redux seems to be the favorite.

http://code.google.com/p/reduxauth/

edited Dec 08 '21 at 08:40

Abdulla Nilam

36,589
17
64
85

answered Mar 24 '09 at 16:49

Jon Winstanley

23,010
22
73
116

score 1 · Answer 2 · answered Mar 23 '09 at 21:58

1

I have used in the past (with excellent results) DX Auth 1.0.6.

You can find it at http://codeigniter.com/forums/viewthread/98465/

answered Mar 23 '09 at 21:58

L. Cosio

227
3
9

score 0 · Answer 3 · edited Dec 08 '21 at 08:41

I would create simple form-based authentication and use a strong password.

HTTP authentication has too many problems IMHO:

Easier to brute force hack.
Anyone who sniffs the request can determine the username and password being used, but they don't even need to; they can just use an identical HTTP themselves.
Once that dialog pops up, it's difficult to dismiss, which can be irritating.
Many browsers will ask twice for a password before letting you in.
It's difficult to log out or change users, you usually have to quit the browser.
Easy to forget that you've let the browser save your credentials, which is another potential security risk.

score -1 · Answer 4 · answered Mar 23 '09 at 20:57

-1

If it is on an apache server, then I would consider just setting up an htpasswd protected directory. Read more about it here.

answered Mar 23 '09 at 20:57

Marius

57,995
32
132
151

1

I thought of this too, but I don't think .htaccess will stop the framework from loading files from the protected directory, i.e. the controller file can be .htaccess protected, but typing in /admin does not prompt for password as /admin is not an actual directory on the server. – jsims281 Mar 23 '09 at 21:07

Codeigniter security - mysql database

4 Answers4