Codeigniter security - mysql database

Question

I'm in the final stages of implementing a CodeIgniter site which requires a really simple login system. One user, and one password to protect the admin area. I think I will be using one of the many CodeIgniter authentication libraries, which should allow me to ensure that people can't read from the database without being logged in as admin (hopefully). Are there any glaring holes in a set up like this? Should I take further measures beyond using of a library like this to ensure the security of the data in the MySQL database? It will be hosted on a shared server; meaning little, or no server config will be possible.

Answer 1

There is a long discussion about the authentication systems available here: How should I choose an authentication library for CodeIgniter?

The latest version of Redux seems to be the favourite.

http://code.google.com/p/reduxauth/

Answer 2

I have used in the past (with excellent results) DX Auth 1.0.6.

You can find it at http://codeigniter.com/forums/viewthread/98465/

Answer 3

I would create simple form-based authentication, and use a strong password.

HTTP authentication has too many problems IMHO:

• Easier to brute force hack.
• Anyone who sniffs the request can determine the username and password being used, but they don't even need to; they can just use an identical HTTP themselves.
• Once that dialog pops up, it's difficult to dismiss, which can be irritating.
• Many browsers will ask twice for a password before letting you in.
• It's difficult to logout or change users, you usually have to quit the browser.
• Easy to forget that you've let the browser save your credentials, which is another potential security risk.

Answer 4

If it is on an apache server, then I would consider just setting up an htpasswd protected directory. Read more about it here.