Login and Password Authentication for Website

Login and Password Authentication Implementation for Websites

Login and password is the classic form of authentication. Despite its simplicity conceptually, correct implementation requires attention to secure credential storage, brute-force protection, and session management.

What's Involved in Implementation

• Login form with client and server validation
• Password hashing (bcrypt, argon2)
• Session or JWT mechanism
• Brute-force protection (rate limiting, lockout)
• "Remember me" functionality (remember token)
• Login attempt logging

Password Storage

Passwords are never stored in plain text. Use bcrypt with cost factor ≥ 12 or Argon2id:

// Laravel
$hash = Hash::make($password); // bcrypt, cost=12 by default

// Verification
if (!Hash::check($request->password, $user->password)) {
    throw new AuthenticationException();
}

// Check if rehash needed (when cost factor changes)
if (Hash::needsRehash($user->password)) {
    $user->update(['password' => Hash::make($password)]);
}

Rate Limiting and Lockout

// Laravel — via RateLimiter
RateLimiter::for('login', function (Request $request) {
    return Limit::perMinute(5)->by($request->ip())
        ->response(fn() => response()->json([
            'message' => 'Too many attempts. Try again in 60 seconds.'
        ], 429));
});

// Additionally — lockout by email+IP for 15 minutes after 10 failed attempts

Remember Me

// Create long-lived token
if ($request->boolean('remember')) {
    $token = Str::random(60);
    $user->update([
        'remember_token' => hash('sha256', $token),
        'remember_token_expires_at' => now()->addDays(30),
    ]);
    Cookie::queue('remember_token', $token, 60 * 24 * 30, secure: true, httpOnly: true);
}

JWT vs Sessions

For server-side rendering (SSR, MPA)—standard cookie sessions. For SPA and mobile clients—JWT (access + refresh token):

Form Security

• autocomplete="current-password" — correct attribute for password managers
• CSRF token in POST request
• Same error message for "no user" and "wrong password"—don't reveal account existence
• HTTPS mandatory

Timeline

Basic login/password implementation with rate limiting, sessions, and remember me—2–3 days.