password security in few step registration form

elemelas

Hi guys,

I'm currently building a few step registration form. First page contains all the account data, so: username, password, email etc. Next i'm passing all the values through the session to next steps, and in the step 4 everything is insterted into the DB.

Now my question: is that safe ? Or, should I ask: how unsafe is it ?

What would be the safest way to pass the password to the next steps, to hash and salt them in step 1 and pass through the session, or pass unencrypted password and hash & salt just before the mysql query ?

Or maybe insert each step directly into the db instead of saving the variables into the session, but I wouldn't really like to do that because when user changes his mind and doesn't finish the registration process he will still leave his details in the DB.

Any suggestions would be highly appreciated!

laserlight

elemelas wrote:
I'm currently building a few step registration form. First page contains all the account data, so: username, password, email etc. Next i'm passing all the values through the session to next steps, and in the step 4 everything is insterted into the DB.

Now my question: is that safe ? Or, should I ask: how unsafe is it ?

Once the data is in a session, it is on your server, so it is "safe". However, unless you are using SSL/TLS, the data would be exposed in the journey from the client computer to your server.

elemelas wrote:
What would be the safest way to pass the password to the next steps, to hash and salt them in step 1 and pass through the session, or pass unencrypted password and hash & salt just before the mysql query ?

That does not matter (as long as you do use a cryptographic hash and a salt), since once the data is on your server, what you do with it is up to you. Neither the user nor an attacker can interfere at that point.

NogDog

If you are on a dedicated host, I don't see any particular issue. If it will run on a shared host where someone might be able to view the session data if stored on the file system, I might recommend a database-driven session implementation.

elemelas

thanks for the advices guys! if anyone has anything else to add - please do 😉