Implement PHP session login with hashed passwords #4

New issue

Open

opened 2026-07-01 01:00:49 +00:00 by manlycucumber · 0 comments

manlycucumber commented

2026-07-01 01:00:49 +00:00

(Migrated from github.com)

Problem

The admin dashboard must be reachable only by authenticated operators. We need a clean-room login flow built on PHP sessions and securely hashed passwords, with no third-party auth dependency.

Acceptance criteria

Passwords are stored using password_hash() with a modern algorithm (Argon2id or bcrypt) and verified with password_verify()
A successful login establishes a regenerated PHP session id and a failed login does not reveal whether the username or password was wrong
Session cookies are set HttpOnly, Secure, and SameSite=Lax
Logout destroys the server-side session and clears the cookie

Notes

Clean-room implementation; do not port any prior auth code. PHP+MySQL runtime only.

## Problem The admin dashboard must be reachable only by authenticated operators. We need a clean-room login flow built on PHP sessions and securely hashed passwords, with no third-party auth dependency. ## Acceptance criteria - [ ] Passwords are stored using `password_hash()` with a modern algorithm (Argon2id or bcrypt) and verified with `password_verify()` - [ ] A successful login establishes a regenerated PHP session id and a failed login does not reveal whether the username or password was wrong - [ ] Session cookies are set HttpOnly, Secure, and SameSite=Lax - [ ] Logout destroys the server-side session and clears the cookie ## Notes Clean-room implementation; do not port any prior auth code. PHP+MySQL runtime only.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Directorium/Site#4

No description provided.

Rows
Columns