title: The definitive guide to form-based website authentication
body: <blockquote>
  <h4>Moderator note:</h4>
  <p>This question is not a good fit for our question and answer format with the <a href="/help/on-topic">topicality rules</a> which currently apply for Stack Overflow. We normally use a &quot;historical lock&quot; for such questions where the content still has value. However, the answers on this question are actively maintained and a historical lock doesn't permit editing of the answers. As such, a &quot;wiki answer&quot; lock has been applied to allow the answers to be edited. You should assume the topicality issues which are normally handled by a historical lock are present (i.e. this question not a good example of an on-topic question for Stack Overflow).</p>
  </blockquote>
  <h2>Form-based authentication for websites</h2>
  <p>We believe that Stack Overflow should not just be a resource for very specific technical questions, but also for general guidelines on how to solve variations on common problems. &quot;Form based authentication for websites&quot; should be a fine topic for such an experiment.</p>
  <h3>It should include topics such as:</h3>
  <ul>
  <li>How to log in</li>
  <li>How to log out</li>
  <li>How to remain logged in</li>
  <li>Managing cookies (including recommended settings)</li>
  <li>SSL/HTTPS encryption</li>
  <li>How to store passwords</li>
  <li>Using secret questions</li>
  <li>Forgotten username/password functionality</li>
  <li>Use of <a href="https://en.wikipedia.org/wiki/Cryptographic_nonce" rel="nofollow noreferrer">nonces</a> to prevent <a href="https://en.wikipedia.org/wiki/Cross-site_request_forgery" rel="nofollow noreferrer">cross-site request forgeries (CSRF)</a></li>
  <li><a href="http://openid.net/" rel="nofollow noreferrer">OpenID</a></li>
  <li>&quot;Remember me&quot; checkbox</li>
  <li>Browser autocompletion of usernames and passwords</li>
  <li>Secret URLs (public <a href="https://en.wikipedia.org/wiki/Uniform_Resource_Locator" rel="nofollow noreferrer">URL</a> protected by digest)</li>
  <li>Checking password strength</li>
  <li>E-mail validation</li>
  <li><em>and much more about</em> <a href="http://en.wikipedia.org/wiki/Form-based_authentication" rel="nofollow noreferrer">form based authentication</a>...</li>
  </ul>
  <h3>It should not include things like:</h3>
  <ul>
  <li>Roles and authorization</li>
  <li>HTTP basic authentication</li>
  </ul>
  <h3>Please help us by:</h3>
  <ol>
  <li>Suggesting subtopics</li>
  <li>Submitting good articles about this subject</li>
  <li>Editing the official answer</li>
  </ol>