# How User Authentication Works on DigitalPlat FreeDomain: Email, OAuth & Security

> Discover how DigitalPlat FreeDomain secures user authentication with email, Google OAuth, Cloudflare Turnstile, and session cookies. Learn about our robust security measures.

- Repository: [DigitalPlat Foundation/FreeDomain](https://github.com/DigitalPlatDev/FreeDomain)
- Tags: how-to-guide
- Published: 2026-02-25

---

**DigitalPlat FreeDomain uses a dual authentication system combining traditional email-password login with Google OAuth, protected by Cloudflare Turnstile anti-bot verification and secure session cookies.**

The authentication architecture in the [DigitalPlatDev/FreeDomain](https://github.com/DigitalPlatDev/FreeDomain) repository implements a classic email-plus-password scheme supplemented by Google single-sign-on. All user authentication interactions flow through HTML front-end forms that POST to `/auth/*` endpoints, with the backend handling credential verification, session management, and OAuth token exchange.

## Authentication Methods Overview

DigitalPlat FreeDomain supports five primary authentication workflows:

| Step | Method | Endpoint | Key File |
|------|--------|----------|----------|
| 1 | **Registration** | `POST /auth/register` | [`opensource/frontend/register.html`](https://github.com/DigitalPlatDev/FreeDomain/blob/main/opensource/frontend/register.html) |
| 2 | **Email Login** | `POST /auth/login` | [`opensource/frontend/login.html`](https://github.com/DigitalPlatDev/FreeDomain/blob/main/opensource/frontend/login.html) |
| 3 | **Google OAuth** | `GET /auth/login/google` | [`opensource/frontend/login.html`](https://github.com/DigitalPlatDev/FreeDomain/blob/main/opensource/frontend/login.html) |
| 4 | **Password Reset** | `POST /auth/reset-password` | [`opensource/frontend/reset_password.html`](https://github.com/DigitalPlatDev/FreeDomain/blob/main/opensource/frontend/reset_password.html) |
| 5 | **Account Management** | `POST /auth/user/edit` | [`opensource/frontend/usermgr.html`](https://github.com/DigitalPlatDev/FreeDomain/blob/main/opensource/frontend/usermgr.html) |

## Registration Flow

### Frontend Implementation

The registration interface in [`opensource/frontend/register.html`](https://github.com/DigitalPlatDev/FreeDomain/blob/main/opensource/frontend/register.html) presents a comprehensive form collecting username, full name, email, phone, address, and password. Client-side validation occurs through the `validateForm` JavaScript function before enabling the submit button.

```html
<form id="registerForm" action="/auth/register" method="POST" class="space-y-6">
    <!-- username, fullname, email, phone, address, password, confirmPassword -->
    <div class="g-recaptcha mb-2" data-sitekey="{{ sitekey }}"></div>
    <button type="submit" id="registerButton" class="btn-primary w-full" disabled>Register</button>
</form>

```

### Backend Processing

When `POST /auth/register` receives the form data, the server executes the following sequence:

1. **Bot Verification**: Validates the Cloudflare Turnstile token to prevent automated registration.
2. **Server-Side Validation**: Re-checks all field constraints (length, format, uniqueness).
3. **Password Hashing**: Applies a strong adaptive hashing algorithm (e.g., bcrypt or Argon2) to the password.
4. **Account Creation**: Stores the user record in the database with the hashed credential.
5. **Email Verification**: Dispatches a verification email containing a one-time token link.

### Registration Example

```bash
curl -X POST https://dash.domain.digitalplat.org/auth/register \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=johndoe" \
  -d "fullname=John Doe" \
  -d "email=john@example.com" \
  -d "phone=+1-5551234567" \
  -d "address=123 Main St, Springfield, USA" \
  -d "password=StrongP@ssw0rd!" \
  -d "confirmPassword=StrongP@ssw0rd!" \
  -d "g-recaptcha-response=TOKEN_FROM_TURNSTILE"

```

## Login Process

### Two-Step Email-Password Login

The login interface in [`opensource/frontend/login.html`](https://github.com/DigitalPlatDev/FreeDomain/blob/main/opensource/frontend/login.html) implements a two-step form to enhance user experience and security. **Step 1** collects the email address. **Step 2** requests the password alongside a Cloudflare Turnstile challenge.

```html
<form id="loginForm" action="/auth/login" method="POST" class="space-y-6">
    <!-- Step 1: email -->
    <input type="email" name="email" id="email" required>
    <button type="button" onclick="nextStep()">Next</button>

    <!-- Step 2: password + Turnstile -->
    <input type="password" name="password" id="password" required>
    <div class="g-recaptcha mb-2" data-sitekey="0x4AAAAAAAxuMrGCYFcOwd1N"></div>
    <button type="submit">Login</button>
</form>

```

Upon `POST /auth/login`, the server validates the Turnstile token, retrieves the user by email, verifies the password against the stored hash, and issues a secure **HttpOnly** session cookie before redirecting to the dashboard.

### Google OAuth Integration

For single-sign-on, the login page provides a Google authentication link at line 70:

```html
<a href="/auth/login/google" class="btn">
    <img src="/static/img/login/glogo.webp" alt="Google"> Sign in with Google
</a>

```

Clicking this initiates `GET /auth/login/google`, which triggers the OAuth 2.0 authorization code flow. The server exchanges the code for an ID token with Google, extracts the user's email, and either logs in an existing account or automatically provisions a new one linked to the Google identity.

## Password Recovery and Account Management

### Password Reset Flow

The password recovery interface in [`opensource/frontend/reset_password.html`](https://github.com/DigitalPlatDev/FreeDomain/blob/main/opensource/frontend/reset_password.html) submits to `/auth/reset-password`. The user provides their email address, and the server generates a time-limited reset token sent via email. The user then accesses a confirmation endpoint to submit a new password.

### Profile Editing

Authenticated users manage their accounts through [`opensource/frontend/usermgr.html`](https://github.com/DigitalPlatDev/FreeDomain/blob/main/opensource/frontend/usermgr.html), which posts to `/auth/user/edit`:

```html
<form id="userEditForm" action="/auth/user/edit" method="POST">
    <input type="email" name="email" id="email" required>
    <input type="text" name="phone" id="phone" required>
    <textarea name="address" id="address" required></textarea>
    <input type="password" name="password" id="password" required>
    <button type="submit" id="updateButton" disabled>Update</button>
</form>

```

The client-side validator (script after line 94) enforces the same constraints as registration. The server re-validates, hashes any new password provided, and updates the stored user record.

## Security Architecture

DigitalPlat FreeDomain implements defense-in-depth across the authentication stack:

- **Password Hashing**: Server-side adaptive hashing (bcrypt or Argon2) protects stored credentials against brute-force attacks.
- **Bot Mitigation**: Cloudflare Turnstile challenges on both registration and login prevent automated abuse.
- **Session Security**: HttpOnly, Secure, and SameSite cookies prevent XSS and CSRF attacks on authenticated sessions.
- **OAuth Safety**: Google SSO follows strict redirect-uri verification and requests minimal scopes (email only).
- **Input Validation**: Dual-layer validation (client-side JavaScript and server-side re-checking) prevents malformed data and injection attacks.
- **Email Verification**: New accounts require confirmation via time-limited tokens before activation.

## Summary

- DigitalPlat FreeDomain supports **email-password** and **Google OAuth** authentication methods through HTML front-end forms posting to `/auth/*` endpoints.
- The **registration** process in [`opensource/frontend/register.html`](https://github.com/DigitalPlatDev/FreeDomain/blob/main/opensource/frontend/register.html) includes client-side validation, Turnstile bot protection, and mandatory email verification.
- **Login** uses a two-step form in [`opensource/frontend/login.html`](https://github.com/DigitalPlatDev/FreeDomain/blob/main/opensource/frontend/login.html) with password hashing verification and secure session cookie issuance.
- **Google SSO** at `/auth/login/google` automatically provisions or links accounts based on Google identity tokens.
- **Account management** through [`opensource/frontend/usermgr.html`](https://github.com/DigitalPlatDev/FreeDomain/blob/main/opensource/frontend/usermgr.html) allows users to update profiles and passwords via `/auth/user/edit`.
- Security measures include bcrypt/Argon2 hashing, HttpOnly cookies, Cloudflare Turnstile, and dual-layer input validation.

## Frequently Asked Questions

### What authentication methods does DigitalPlat FreeDomain support?

DigitalPlat FreeDomain supports traditional **email and password** authentication alongside **Google OAuth** single-sign-on. The email-password method requires account registration through [`opensource/frontend/register.html`](https://github.com/DigitalPlatDev/FreeDomain/blob/main/opensource/frontend/register.html), while Google OAuth provides streamlined access without manual password creation.

### How does the two-step login process work?

The login interface in [`opensource/frontend/login.html`](https://github.com/DigitalPlatDev/FreeDomain/blob/main/opensource/frontend/login.html) splits authentication into two stages: **Step 1** collects the email address, and **Step 2** requests the password alongside a Cloudflare Turnstile challenge. This design improves user experience by validating the account exists before requesting credentials, while the Turnstile widget prevents automated brute-force attacks.

### Is Google OAuth mandatory for using DigitalPlat FreeDomain?

No, Google OAuth is **optional**. Users can create accounts entirely through the email-password registration form in [`opensource/frontend/register.html`](https://github.com/DigitalPlatDev/FreeDomain/blob/main/opensource/frontend/register.html). The Google SSO option simply provides an alternative for users who prefer not to manage separate passwords for the service.

### What security measures protect user accounts during authentication?

DigitalPlat FreeDomain implements multiple security layers: **adaptive password hashing** (bcrypt or Argon2) protects stored credentials, **Cloudflare Turnstile** blocks automated registration and login attempts, **HttpOnly Secure cookies** prevent XSS attacks on sessions, and **dual-layer validation** ensures both client-side and server-side input checking. Additionally, new accounts require **email verification** via time-limited tokens before activation.