Ik ben bezig met het opstellen van richtlijnen voor het programmeren van een login. Het is wel in het engels. Misschien hebben jullie nog toevoegingen:

-Passwords should never be stored in plain-text ; use md5(“oursalt”.md5($pass)) instead
-Passwords should at least have a length of 9 characters by default ; Customer should be able to adjust this setting according to their companies password policy
-Passwords should be able to be large to allow passfrases (length of at least 256)
-Passwords should be able to hold upper- and lowercase alpanummeric,nummeric and symbols characters

-Users should be able to change their password
-Users should provide their old password when changing their password
-Users should be forced to change their password monthly by default ; Customer should be able to adjust this setting according to their companies password policy
-User should be able to request new (randomly generated) password in case he/she forgot his password

-Login form should block false passwords with a single username after 3+ false retries for at least (false retries/3)*5 minutes
-Login form should block false login attempts from the same IP after 3+ false attempts for at least (false retries/3)*5 minutes
-Login form should not disclose existence of user accounts ; texts like “user does not exist” and “wrong password” should be replaced with “username and/or password incorrect”

-After login , the user should be reported about the last login date/time and failed login attempts

Graag jullie reactie hier op

Greetingz,
Jacco