How User Authentication Works on DigitalPlat FreeDomain: Email, OAuth & Security

DigitalPlat FreeDomain uses a dual authentication system combining traditional email-password login with Google OAuth, protected by Cloudflare Turnstile anti-bot verification and secure session cookies.

The authentication architecture in the DigitalPlatDev/FreeDomain repository implements a classic email-plus-password scheme supplemented by Google single-sign-on. All user authentication interactions flow through HTML front-end forms that POST to /auth/* endpoints, with the backend handling credential verification, session management, and OAuth token exchange.

Authentication Methods Overview

DigitalPlat FreeDomain supports five primary authentication workflows:

Step	Method	Endpoint	Key File
1	Registration	POST /auth/register	opensource/frontend/register.html
2	Email Login	POST /auth/login	opensource/frontend/login.html
3	Google OAuth	GET /auth/login/google	opensource/frontend/login.html
4	Password Reset	POST /auth/reset-password	opensource/frontend/reset_password.html
5	Account Management	POST /auth/user/edit	opensource/frontend/usermgr.html

Registration Flow

Frontend Implementation

The registration interface in opensource/frontend/register.html presents a comprehensive form collecting username, full name, email, phone, address, and password. Client-side validation occurs through the validateForm JavaScript function before enabling the submit button.

<form id="registerForm" action="/auth/register" method="POST" class="space-y-6">
    <!-- username, fullname, email, phone, address, password, confirmPassword -->
    <div class="g-recaptcha mb-2" data-sitekey="{{ sitekey }}"></div>
    <button type="submit" id="registerButton" class="btn-primary w-full" disabled>Register</button>
</form>

Backend Processing

When POST /auth/register receives the form data, the server executes the following sequence:

1. Bot Verification: Validates the Cloudflare Turnstile token to prevent automated registration.
2. Server-Side Validation: Re-checks all field constraints (length, format, uniqueness).
3. Password Hashing: Applies a strong adaptive hashing algorithm (e.g., bcrypt or Argon2) to the password.
4. Account Creation: Stores the user record in the database with the hashed credential.
5. Email Verification: Dispatches a verification email containing a one-time token link.

Registration Example

curl -X POST https://dash.domain.digitalplat.org/auth/register \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=johndoe" \
  -d "fullname=John Doe" \
  -d "email=john@example.com" \
  -d "phone=+1-5551234567" \
  -d "address=123 Main St, Springfield, USA" \
  -d "password=StrongP@ssw0rd!" \
  -d "confirmPassword=StrongP@ssw0rd!" \
  -d "g-recaptcha-response=TOKEN_FROM_TURNSTILE"

Login Process

Two-Step Email-Password Login

The login interface in opensource/frontend/login.html implements a two-step form to enhance user experience and security. Step 1 collects the email address. Step 2 requests the password alongside a Cloudflare Turnstile challenge.

<form id="loginForm" action="/auth/login" method="POST" class="space-y-6">
    <!-- Step 1: email -->
    <input type="email" name="email" id="email" required>
    <button type="button" onclick="nextStep()">Next</button>

    <!-- Step 2: password + Turnstile -->
    <input type="password" name="password" id="password" required>
    <div class="g-recaptcha mb-2" data-sitekey="0x4AAAAAAAxuMrGCYFcOwd1N"></div>
    <button type="submit">Login</button>
</form>

Upon POST /auth/login, the server validates the Turnstile token, retrieves the user by email, verifies the password against the stored hash, and issues a secure HttpOnly session cookie before redirecting to the dashboard.

Google OAuth Integration

For single-sign-on, the login page provides a Google authentication link at line 70:

<a href="/auth/login/google" class="btn">
    <img src="/static/img/login/glogo.webp" alt="Google"> Sign in with Google
</a>

Clicking this initiates GET /auth/login/google, which triggers the OAuth 2.0 authorization code flow. The server exchanges the code for an ID token with Google, extracts the user's email, and either logs in an existing account or automatically provisions a new one linked to the Google identity.

Password Recovery and Account Management

Password Reset Flow

The password recovery interface in opensource/frontend/reset_password.html submits to /auth/reset-password. The user provides their email address, and the server generates a time-limited reset token sent via email. The user then accesses a confirmation endpoint to submit a new password.

Profile Editing

Authenticated users manage their accounts through opensource/frontend/usermgr.html, which posts to /auth/user/edit:

<form id="userEditForm" action="/auth/user/edit" method="POST">
    <input type="email" name="email" id="email" required>
    <input type="text" name="phone" id="phone" required>
    <textarea name="address" id="address" required></textarea>
    <input type="password" name="password" id="password" required>
    <button type="submit" id="updateButton" disabled>Update</button>
</form>

The client-side validator (script after line 94) enforces the same constraints as registration. The server re-validates, hashes any new password provided, and updates the stored user record.

Security Architecture

DigitalPlat FreeDomain implements defense-in-depth across the authentication stack:

• Password Hashing: Server-side adaptive hashing (bcrypt or Argon2) protects stored credentials against brute-force attacks.
• Bot Mitigation: Cloudflare Turnstile challenges on both registration and login prevent automated abuse.
• Session Security: HttpOnly, Secure, and SameSite cookies prevent XSS and CSRF attacks on authenticated sessions.
• OAuth Safety: Google SSO follows strict redirect-uri verification and requests minimal scopes (email only).
• Input Validation: Dual-layer validation (client-side JavaScript and server-side re-checking) prevents malformed data and injection attacks.
• Email Verification: New accounts require confirmation via time-limited tokens before activation.

Summary

• DigitalPlat FreeDomain supports email-password and Google OAuth authentication methods through HTML front-end forms posting to /auth/* endpoints.
• The registration process in opensource/frontend/register.html includes client-side validation, Turnstile bot protection, and mandatory email verification.
• Login uses a two-step form in opensource/frontend/login.html with password hashing verification and secure session cookie issuance.
• Google SSO at /auth/login/google automatically provisions or links accounts based on Google identity tokens.
• Account management through opensource/frontend/usermgr.html allows users to update profiles and passwords via /auth/user/edit.
• Security measures include bcrypt/Argon2 hashing, HttpOnly cookies, Cloudflare Turnstile, and dual-layer input validation.

Frequently Asked Questions

What authentication methods does DigitalPlat FreeDomain support?

DigitalPlat FreeDomain supports traditional email and password authentication alongside Google OAuth single-sign-on. The email-password method requires account registration through opensource/frontend/register.html, while Google OAuth provides streamlined access without manual password creation.

How does the two-step login process work?

The login interface in opensource/frontend/login.html splits authentication into two stages: Step 1 collects the email address, and Step 2 requests the password alongside a Cloudflare Turnstile challenge. This design improves user experience by validating the account exists before requesting credentials, while the Turnstile widget prevents automated brute-force attacks.

Is Google OAuth mandatory for using DigitalPlat FreeDomain?

No, Google OAuth is optional. Users can create accounts entirely through the email-password registration form in opensource/frontend/register.html. The Google SSO option simply provides an alternative for users who prefer not to manage separate passwords for the service.

What security measures protect user accounts during authentication?

DigitalPlat FreeDomain implements multiple security layers: adaptive password hashing (bcrypt or Argon2) protects stored credentials, Cloudflare Turnstile blocks automated registration and login attempts, HttpOnly Secure cookies prevent XSS attacks on sessions, and dual-layer validation ensures both client-side and server-side input checking. Additionally, new accounts require email verification via time-limited tokens before activation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}