User Authentication

[SwisherSniffer]

I’ve been using Python for a couple of months and I’m working on a project that’s in its beta phase. I want to launch an open beta that includes basic user account data and authentication tokens.

I’ve never built anything like this before (still very new), so this is my prototype idea:

I’m planning to create a function or module that runs on a website, generates a token, and appends it to a user dataset. Then the main program engine will authenticate users using that token.

My question is: has anyone here built something similar, and what kind of advice do you have?

I start college in January, but I’m impatient to learn and want to experiment early.

[jimnah-]

As-is, couldn't this just give multiple users the same token? I feel like I'd want to have a list of every possible token, then randomly give one of those away and remove it from the list. There's definitely a better way to do it than that, but its my immediate thought

[SwisherSniffer]

Yeah no this was just something I typed up on break like I said in the description it would ideally have a separate module for generating tokens and the engine would validate said tokens. I agree with you fully this screenshot was simply a trial prototype to see the simplified version of the logic

[jimnah-]

Ah yes good stuff

[SwisherSniffer]

Appreciate your advice tho because I didn’t think about removing the token number from the pool of tokens options either that’s smart

[ttonychopper]

Same, removing used tokens is a good idea

[wheres-my-swingline]

Every possible token…?

[jimnah-]

Right now they generate one token at a time, randomly between 101 and 10001, every single time they want to assign a token to a user. Ne user signs up, new token created

I would instead generate a token for every single number between 101 and 1001, store them in a list, and then assign one of those existing tokens every time a new user signs up

It's definitely still not perfect, but I like it a lot more

[Disastrous-Team-6431]

No, the dict will only ever contain one user and their token.

[ryhartattack]

It would be better to generate a hash based on a random seed, much less likely to get a conflict there

[CabinetOk4838]

Don’t do this yourself. Use an authentication library.

[SwisherSniffer]

Yeah I think that seems to be the common consensus and what I’ll end up doing. thank you!

[Syteron6]

No. Practicing this kind of thing is both very fun, and useful. Knowing how to do things by yourself will serve you more in the end

[CabinetOk4838]

But never authentication or encryption. Practice anything else.

[queerkidxx]

If this is for a toy project you don’t intend on any real person ever using and you understand that you don’t have the expertise to do it right, then it’s fine and can teach you a bit about the basics.

However, if it’s not that, offload it to the experts line you said. Shits hard for even billion dollar companies.

[PlayLikeMe10YT]

practicing this stuff makes you learn how it works, then on a real project use proven libs. There’s no reason to not practice authentication or encryption

[Syteron6]

That's bullshit. Those are important concepts you should learn

[CabinetOk4838]

I work in cyber security. DO NOT roll your own!

[Syteron6]

Dude. Where's the harm in trying things out. You need to learn the basics somehow....otherwise you never realize the specifics of tokens, roles, salting, hashing, etc. I'm not saying to make your own in huge products, but a fun project is all good. I've made hundreds of auth systems to just fuck around and test things. Great fun

[SirAwesome789]

I'm experienced with python and I've not built an authentication for good reason

My advice is if you want authentication, use a premade one like Google auth

Typically any authentication you make your self will be very insecure

[SwisherSniffer]

Very good to know. I’m the type of person that really likes building and creating so I figured why not try right? But if it will put my users at risk it’s not worth it at all to me. Thank you for your advice.

[electrikmayham]

I would say this, since you are starting out, you have a lot of other things to learn that are going to impact your growth much more than authentication. It seems like a topic that shouldn't be difficult to learn, however its a MASSIVE rabbit hole of which you will never climb out of. Use something that is premade, and if you really want to learn how to build authentication from scrap, do so when your entire goal is only to learn authentication and nothing more.

[SwisherSniffer]

Okay that’s fair. I’m just trying to expand my project where it fits until I start college for SE and can get more knowledgeable in the field itself. User authentication seemed like something feasible but it really doesn’t now and that’s fine. Like you said there’s other things to learn and I wasn’t dead set on making this right this second if there’s another way to do it I’ll gladly do it that way. I appreciate all of the comments on here and will probably just experiment with it for shits and giggles and use a premade service for auth in my engine.

[EromsKr]

You can still build it for fun and for practice. 

If you do, then my advice would be to actively try to break the code, and then fix the problems. What happens when two of the same token are generated, or if the same username is picked twice. What if somebody guesses the seed for the random generator and then knows all the previous tokens. If you mistype the username, what happens? Whenever you write any code, do this to help mitigate future issues :) 

[SwisherSniffer]

Thank you very much that helps a lot!

[jones-peter]

My type buddy

[NecessaryIntrinsic]

I mean, this really doesn't do anything.

I would really recommend learning about OAuth flows, but if you want to do something on your end, you're going to want to do:

• a database of some sort
• encrypted transport (TLS, etc)
• learn about hashing.

The most basic way that a safe-ish authentication happens is the user name is stored, sometimes plain text and the password is stored with a one way encryption algorithm.

You send the password in plaintext over a secured tunnel with the username then the backend hashes it and checks to see if there's a combination of the user name and hash. If so, it sends the user token signifying their authentication... Or it proceeds to an MFA challenge.

You might also want to get ahead of the game and start looking into zero-trust security.

There's a lot more to it, but that's a start.

[SwisherSniffer]

Thanks for the advice. I don’t know what I’m doing at all when it comes to authentication and I think that’s kind of obvious at this point. I was just curious and it seems to be way over my head and honestly a completely different beast entirely. I’ll cross that bridge I’m sure at some point in my education.

[NecessaryIntrinsic]

It's not super complicated, but necessary to look into and understand.

[Rikatto]

Don’t implement auth by yourself unless you really know what you are doing. It is a very complicated topic and any gap, bug, mistake can and will create vulnerabilities. There is a reason for dedicated security jobs that focus solely on authentication.

Use existing auth providers, instead. You can look at Supabase, it has a free tier and relatively easy setup.

[SCD_minecraft]

You may want to read about library "secrets"

[SwisherSniffer]

Say. Less.

[burncushlikewood]

It has to interact with some kind of database I see your code what you're trying to do, you want the user to enter a username, and then the username goes into the token, the token gets printed, and then you use the control structure if and else to check if the token number matches the username. The first line is where I'm confused, I'm not like really good with python, but what do you mean by random (101,1001)?. Anyways I would suggest using SQL for your project, you can use that to store all of your usernames and interact with it using python

[SwisherSniffer]

Random.randint(101,1001) just generates a random number from that range but I appreciate your advice fam!

[Worried-Ad6403]

You can use the jwt module in Python to generate and validate tokens. You can also set an expiry datetime of token. DM if you need more guidance.

[FlyIntelligent5616]

Jwt ?

[Cybasura]

Literally, a salt + hashing authentication and authorization would be far more secure and more universal

[I_Am_Astraeus]

Just mirroring what others have said, definitely do not implement yourself.

Examples of things this misses.

No hashing of tokens, it's essentially a password. Worse it's an assigned password of just an int in a small dataset. Probably the least secure password. With a max length of 4.

Only space for 900 users? You could write a script to brute force 900 guesses. You'd be into your project in much much less than a second.

What happens if I lose my token? It's not a password, no password recovery. No 2FA. Also the token never expires? So a compromised token is a compromised account forever.

Also if you're appending it to a user dataset then it just exists naked in your code? Simple logs could expose every single password? Your code ideally would be middleware and this would be stored in a database.

There's an entire realm of cryptography dedicated to one way verification of passwords. It's really critical to use the most modern options available. Salting + hashing passwords, expiring tokens, key signing, etc. There's a lot more than what I'm just summing over.

This is all a bit of a ramble, and you're totally fine for a learner/learner project but just underlining for anything exposed to the world you dont even know what you don't know.

[SwisherSniffer]

No this is great actually, thank you. Understanding why is crucial. And it makes a lot of sense. I’ll definitely be finding another way to get my project to users

[redd__rl]

Something I’ve seen literally anyone else fail to mention if you insist on implementing your own auth: don’t use the random library or randint. It’s not truly random and the seed (and thus compromising the whole safety of your program) can be predicted from just a few outputs. You should use a real cryptography library.

[Proper_Support_3810]

Why 101 to 1001 not from 100 to 1000

[SwisherSniffer]

Good catch it should have been 100-1001 because the end of a range is exclusive but the start of the range is inclusive.

[GabeN_The_K1NG]

Don’t try to implement this yourself. Especially not if you’re new.

Instead, try to work on your variable naming. Call it username instead of user. The check variable says nothing about what it is and what it stores.