Techniques for Writing Secure Code

Authentication/authorization

• Authenticate user, and ensure no one can do more than should be possible

• If authentication is done properly, it narrows greatly the number of users who can attempt attacks

• Use existing authentication infrastructure when possible. At UF, you can use Gatorlink Authentication

  http://login.gatorlink.ufl.edu/support/index.html

• If using passwords, store them in a file as an encrypted hash

              user        = getuser()
              pass        = getpassfromuser()
              hash        = get_crypted_hash(user)
              newhash     = encrypt(pass)
  
              if (hash == newhash) 
                  print Hooray
              else
                  don't print Hooray
              end