FlexAccount
FlexAccount is a simple login system for Flex based applications. It’s designed to be used as a starting point for Flex applications that need to let users log in, and takes care of some of the mundane aspects of that.
Using FlexAccount is easy. Install the PHP files on your server, create the databaes, add the LoginPanel UI to your application, and then carry on with building the more interesting parts of your application.
User passwords are salted and hashed, with a unique salt per user. Passwords are transmitted plaintext, so that the server, not the client, decides if a password is “secure enough”. This means your login and account creation pages should be SSL-encrypted!
Login attempts are throttled after 2 failed attempts – a fail status is immediately returned until a timeout has passed (5 seconds per attempt after 2 attempts), so a scripted brute force attack on a user’s password is unlikely to succeed. Only one password reset is allowed per 24 hour period.
Once a user is logged in, a session token is returned to the client, and the client submits that along with any future requests. This token can be stored locally instead of remembering the user’s login and password. If a user changes their password, the session token is regenerated, so any clients that have cached the session token will be required to prompt for a password on next login. (In other words, if you log in at a friend’s place and forget to log out, you can go home and change the password, and that invalidates the login at the friend’s place).
FlexAccount lets you use either a username or email address to log in.
FlexAccount is distributed as some PHP files to install on your web host, SQL that creates the tables it needs, a Flex component that you can use in your Flex applications, and a sample that you could use as a starting point for an application that needs to let users log in.
If you want to see what it looks like, here’s the FlexAccount GuestBook Sample Application. It lets you log in, change your password, deals with forgotten passwords and all that other mundane stuff using FlexAccount. You can View Source on the sample app to see how it works.