Understanding Web Login Security: Risks, Encryption Methods, Tokens, and Digital Signatures

This article uses a web login example to explore security issues, emphasizing that login is not just a simple form submission but a critical point for protecting user credentials.

1. A Simple HTML Example to Examine User Information Security

Standard HTML allows the use of <input></input> tags within a <form> to create HTTP submissions. A typical login form looks like:

<form action="Application/login" method="POST">
   用户名：<input id="username" name="username" type="text"/>
   密码：<input id="password" name="password" type="password"/>
   <button type="submit">登陆</button>
</form>

When the form is submitted, the name attributes become parameters in the HTTP request body for backend validation.

Even though the password field displays as dots, network tools like Chrome DevTools can capture the request in clear text.

2. HTTP Protocol Directly Exposes Password Fields

During transmission, sniffing tools such as Fiddler or Wireshark can capture HTTP packets that contain sensitive information, demonstrating the risk of plain‑text exposure.

3. Can Encryption Algorithms Ensure Password Security?

Front‑end code can encrypt passwords before sending them, using either symmetric or asymmetric encryption.

Symmetric encryption uses the same key for both encryption and decryption.

Asymmetric encryption uses a public key for encryption and a private key for decryption.

3.1 Using Symmetric Encryption

A simple example shifts and reverses the password string:

123456 --> 456123

Then reverse:

456123 --> 321654

Drawbacks:

Both front‑end and back‑end must modify code simultaneously.

JavaScript encryption can be reverse‑engineered, exposing the algorithm.

3.2 Is HTTPS Always Secure?

HTTPS provides transport‑level encryption but does not guarantee that the ciphertext cannot be intercepted on the client or server side, and it is vulnerable to man‑in‑the‑middle attacks if a malicious certificate is installed.

4. Conclusion: Passwords Must Be Transmitted as Ciphertext Regardless of HTTP or HTTPS

Because HTTPS alone cannot fully protect passwords, an additional application‑layer protection such as hashing (e.g., MD5) is recommended: store MD5(password) in the database and hash the password on the client before transmission.

Advantages:

Protects stored passwords.

Prevents plaintext exposure during transmission.

Simple, efficient, and widely supported.

5. Why MD5 Alone Is Not Sufficient

Even with MD5 hashing, an attacker can replay the hashed value to authenticate, because the server compares the received hash directly with the stored hash.

5.1 Solution 1: Captcha

Generate a captcha on the server, store its value in the session, and require the user to submit it alongside credentials.

5.2 Solution 2: Token

In a front‑end/back‑end separated architecture, issue a random token (e.g., UUID) stored in Redis after successful login; the client must include this token in subsequent authentication requests, preventing replay attacks.

6. Beware of Data Tampering

Even with encrypted passwords and tokens, attackers can modify other request fields (e.g., change the amount in a payment request). Digital signatures, which combine a hash of the data with the sender’s private key, can ensure integrity.

6.1 What Is a Digital Digest?

A one‑way hash function produces a fixed‑length fingerprint of the original data, used to verify that the data has not been altered.

6.2 Digital Signature

The sender hashes the message, encrypts the hash with their private key, and sends both the message and the encrypted hash. The receiver hashes the received message and decrypts the signature with the sender’s public key; matching hashes confirm authenticity and integrity.

7. Summary

Web login appears simple but contains many security pitfalls; the article outlines practical mitigation strategies such as hashing, token validation, captchas, and digital signatures to improve authentication security.

Supplement 1: JS Encryption Functions Can Be Cracked

Attackers can read front‑end JavaScript, discover the encryption algorithm, and potentially forge valid check codes.

Supplement 2: MD5 Has Known Vulnerabilities

MD5 is vulnerable to collisions; modern systems should prefer stronger algorithms like bcrypt, PBKDF2, or Argon2.