---

The login process seems to be quite mysterious, but thanks to the developper toolbar and Firebug you can see it completly naked 🙂

The screencast is here : http://screencast.com/t/eiiGjNt7

So it works like this :
- The action is the same url (and the form can display errors).
- The form initially contains several hidden values that will make the submit action more secure.
- When the focus is set to the password field, the form verifies that the encryption parameters are OK, and indicates it with a brown padlock.
- Before been submitted, the password is encrypted into two md5+salt values, and the non-encrypted password field is erased : Therefore the password is never directly sent to the server, so it can’t be catched by a bad guy. That makes the login form really secure !
- Finally, the server calculates the md5+salt values of the password in database. It compares these values to the encrypted received values. If the values match, the password that has been submitted is correct. Elsewhere it’s bad and SPIP returns to the login form with an error.

Enjoy !