# Authentication system using AJAX

I'm building an authentication system using a combination of PHP, MySQL, jQuery, and AJAX. The way I'm doing it right now is I have a form that takes in a username and password. When the user clicks on the login button I pass the value of those two values along with an action to a controller file. That controller file will use an Authentication object (I wrote my own Authentication class) to determine if the user is authenticated or not. If so, it will return a string that says "authenticated" or something similar. I check for that value in the response of the AJAX request and go from there based on the response. Of course I do all sorts of server side checks so someone can't just navigate to a certain section or tamper with my jQuery to trick the system. It's all enforced behind the scenes.

Is this acceptable? Is there any major problem with doing this the way I am? Here are some snippets of my code that is responsible for handling all this:

Login section:

<div data-role="content">
<div class="center" id="loginContainer" data-role="fieldcontain">
<input id="username" type="text" placeholder="Username" />
<input id="password" type="password" placeholder="Password" />
<br />
<a id="loginButton" href="#" data-role="button" data-inline="true">Login</a>
</div>
</div>

jQuery:

$(document).on("click", "#loginButton", function() { var user =$("#username").val();
var pass = $("#password").val();$.post("controllers/auth.php", {"action": "authenticate", "user": user, "pass": pass}, function(data) {
if(data == "authenticated") {
//stuff
}
});
});

Controller:

if(isset($_POST['action']) &&$_POST['action'] == "authenticate") {
$credentials = array("user" =>$_POST['user'], "pass" => $_POST['pass']);$auth = new Auth($dbh,$ldaps, $credentials); if($auth->authenticate()) {
echo "authenticated";
}
}
-

## 1 Answer

Do all URLs on your site use SSL? If not you'll need to setup your site to at least support the authenticate URL over HTTPS.
Currently your passing a plain text Username and Password - anyone can grab them.

On requests after the login, how are you determining whether or not the user is authenticated? It does not look like you are persisting the login in any way, unless Auth class is doing it behind the scenes. Typically this is done with a session variable or cookie.

-
I don't have SSL enabled at the moment but I will eventually. Since it's not finished yet I am really more concerned with my implementation since I haven't done too many authentication systems with AJAX. The way I'm checking to see if they're authenticated is by checking a certain session variable on pages that are in an administration folder. I didn't post all of the checking, sanitization, and persistence code because everything is working the way it should; I just want to make sure that the way I'm handling the initial login with AJAX was okay. –  Aaron Jan 17 '13 at 20:36
Will people be logging in from a non-SSL page? If so, it will quickly become a large concern and you'll want to start looking at how that will affect your login function now, because of the 'same domain origin policy'. –  s_hewitt Jan 17 '13 at 20:49
Separate from SSL and any security issues, everything else looks typical. –  s_hewitt Jan 17 '13 at 20:51
Nope, the login and all pages following will be over SSL. Thank you for your feedback! –  Aaron Jan 17 '13 at 20:52