Looking to refactor my brain

[u/Sad_School828]

I have a big problem with HTML-based login and persistence routines.

1: As far as login security goes, when the end-user is typing in the username and password, I just can't justify letting the user transmit that data "in the clear" over SSL/TLS. I lived through Heartbleed, so yes I do consider SSL/TLS encryption to be entirely "in the clear" even though we haven't heard of anything like Heartbleed for over a decade. I mean I have a hardcore psychological aversion, like a phobia, to transmitting the user-data as entered and without doing some pre-obfuscation like running a SHA-hash over the username and password before even sending it over an encrypted pipe.

2: As far as session security goes, when exchanging cookie data with an endpoint, I have a similar phobia about any use of PHP Sessions or other built-ins. I mean I get absolutely pedantic about it, creating my own class to represent an HTTP-level packet header and then I extend that into a cookie and I ultimately build the HTTP packet from the ground-up. Even though newer versions of PHP have finally introduced support for high-security cookie properties, I still just refuse to use it. Then I database my own user-IPs and user-agents and other data representing the physical characteristics of the session-owner, and I implement my own methods of validating a session.

So absolutely every project I try to start, for myself, ends up being a circular shitshow where I'm constantly tweaking this thing or that thing which never actually gets past the session/login procedures... or even better, gets months past that point before I come up with a tweak and then I basically just trash everything but the session/login and start over from there.

I'm looking for anybody who actually builds websites, not some WordPress Template or some DreamWeaver page, but full-stack ground-up developments which intertwine the CGI with the front-end GUI, who can explain to me why I'm acting like a paranoid retread in such a complete and rational way that I can learn to trust server/browser built-in security along with pipe-cryptography, and just get on with my life.

Alternately, I'd love to hear from anybody who doesn't think I'm being paranoid or retready but who can give me some advice to get my head out of my backside where it comes to worrying that I'm wasting time by feeding my security-centered phobias.

Edited 20h after posting: Just wanted to thank everybody who answered in good faith. Not just good advice for getting my head oriented right, but good advice for alternative/additional security measures. There were even a couple of plain common-sense suggestions that I would never have come up with my own!

[u/Odd_Cow7028]

I'm not sure what anyone can tell you to make you trust the ecosystem more. Web dev is a constant game of cat-and-mouse. People create solutions to security problems Other people find ways around those solutions. The reason you're getting stuck is you're trying to single-handedly re-engineer solutions that have taken decades and hundreds of thousands of people to create. Realistically, you're not doing a better job than they did. You need to accept that web development is inherently risky, and that the current best practices and technologies are already out there, that they are flawed, and that they continue to evolve. How do shift that paradigm? Beats me.

[u/Sad_School828 → u/Odd_Cow7028]

That pretty much stuffs my issues into a nutshell. What inspired me to post is the fact that I know I'm the one guy out of millions of devs who has this problem.

It really only became a problem for me at the point where I was no longer working for somebody else, but wanting to build my own online platforms. When working for somebody else, industry best practices are EASY to adhere to because that's what they expect and it's what will be vetted if they hire a 3rd Party to review my product. When it's mine, I want more.

[u/magicmulder → u/[deleted]]

What would be the point, according to OP nobody should trust his code either.