Pass Username Email containing Request a Lost reset key key for a user who has lost their password Pass UserID (Success) Choose a Reset Reset Key Success new Code password (Failure) for the user Error Code Error Message Add UserID (Success) Add a user Success to a game as Key an observer. Code GameID (Failure) Error Code Message The management page requested by both the physical chess board as well as the web interface will be the log in page. The log in page takes as input a POST request from a web client with the parameters to include a plaintext username and a SHA-1 hash of that user's password. It will take the plaintext username and apply a SHA-1 hash to it as well before concatenating the result with the password's hash. The salted password hash is then hashed once again with SHA-1. The resulting string is compared to the contents of the user's password as it is stored in the users table of the database. If it matches, a response is created containing the user's user id number and an authentication key that must be resubmitted with each other request. This authentication key is concatenated with the user's remote IP address and is then hashed and stored in the table. Further requests to management pages must submit the authentication key correctly and be coming from the same IP address, or else the management page being requested will return a status code 403 - Forbidden error. The system cannot use the more standard method of storing authentication via client-side cookie relating to server-side sessions because the chess board is incapable of storing cookies.
Pass Lost Username Email containing reset key Request a key for a user who has lost their password Pass Reset UserID Reset Key (Success) Success Code (Failure) Error Code Error Message Choose a new password for the user Add UserID Key GameID (Success) Success Code (Failure) Error Code Message Add a user to a game as an observer. The management page requested by both the physical chess board as well as the web interface will be the log in page. The log in page takes as input a POST request from a web client with the parameters to include a plaintext username and a SHA-1 hash of that user's password. It will take the plaintext username and apply a SHA-1 hash to it as well before concatenating the result with the password's hash. The salted password hash is then hashed once again with SHA-1. The resulting string is compared to the contents of the user's password as it is stored in the users table of the database. If it matches, a response is created containing the user's user id number and an authentication key that must be resubmitted with each other request. This authentication key is concatenated with the user's remote IP address and is then hashed and stored in the table. Further requests to management pages must submit the authentication key correctly and be coming from the same IP address, or else the management page being requested will return a status code 403 - Forbidden error. The system cannot use the more standard method of storing authentication via client-side cookie relating to server-side sessions because the chess board is incapable of storing cookies.
Senior%20Design%20I%20-%20Final%20Document.docx