<![CDATA[User authentication and verification security are essential aspects of web-based applications, as insecure credential storage may increase the risk of password disclosure and unauthorized access to the system. This study aims to implement and evaluate a user security mechanism in an inventory application by employing bcrypt for password protection, SHA-256 for verification token generation, and One-Time Password (OTP) for email ownership verification. The study adopted a software engineering approach consisting of security requirement identification, security mechanism design, implementation, and functional and performance testing. Bcrypt was implemented with a cost factor of 12 in the application, while its performance was evaluated using cost factors of 8, 10, 12, and 14 by measuring password hashing and verification times. SHA-256 was employed to generate a verification token from a combination of the user's email address, time information, and a unique identifier, whereas a six-digit OTP was delivered via email and validated against the value temporarily stored in the session. The functional testing results demonstrated that the system successfully authenticated verified accounts with correct passwords while rejecting incorrect passwords, unverified accounts, and invalid OTPs. Increasing the bcrypt cost factor resulted in higher computational time. The hashing times for cost factors 8, 10, 12, and 14 were 45.2 ms, 98.7 ms, 385.4 ms, and 1,542.8 ms, respectively, while the corresponding verification times were 43.8 ms, 96.3 ms, 382.1 ms, and 1,538.6 ms. In the email verification process, OTP generation required 2.1 ms, email delivery required 847.3 ms, and OTP validation required 1.8 ms. These results indicate that bcrypt, SHA-256, and OTP can be integrated as distinct yet complementary security mechanisms, while the selection of an appropriate bcrypt cost factor should consider the trade-off between security requirements and system processing time.]]>
