How can PHP be used to implement a secure login system with one-time passwords?

To implement a secure login system with one-time passwords in PHP, you can generate a unique token for each login attempt and validate it against the user's input. This token can be generated using a combination of the user's password, a random salt, and a timestamp to ensure it is only valid for a short period of time. 

<?php

function generateOneTimePassword($password) {
    $salt = bin2hex(random_bytes(16));
    $timestamp = time();
    $token = hash('sha256', $password . $salt . $timestamp);
    
    return array('token' => $token, 'salt' => $salt, 'timestamp' => $timestamp);
}

function validateOneTimePassword($password, $token, $salt, $timestamp) {
    $currentTimestamp = time();
    $validTimestamp = $currentTimestamp - 60; // Token is valid for 1 minute
    
    if ($currentTimestamp < $validTimestamp || $currentTimestamp > $timestamp) {
        return false;
    }
    
    $generatedToken = hash('sha256', $password . $salt . $timestamp);
    
    return hash_equals($token, $generatedToken);
}

// Example of generating and validating a one-time password
$userPassword = 'password123';
$oneTimePassword = generateOneTimePassword($userPassword);

$token = $oneTimePassword['token'];
$salt = $oneTimePassword['salt'];
$timestamp = $oneTimePassword['timestamp'];

$isPasswordValid = validateOneTimePassword($userPassword, $token, $salt, $timestamp);

if ($isPasswordValid) {
    echo 'Login successful!';
} else {
    echo 'Login failed. Please try again.';
}

?>

Keywords

PHP secure login system one-time passwords authentication encryption

Related Questions