Clarification on .htaccess

[gbraden]

Website access. I have a customer who wants to have part of his website opened only to registered users. I see a lot of websites doing this, but I am wondering if this is more than simply setting up .htaccess. We will be using Apache 1.3 on a Linux machine with PHP and MySQL.

Thanks in advance






Glen Braden

 

[feherke]

Hi

I see a lot of websites doing this, but I am wondering if this is more than simply setting up .htaccess.

Well, depends on what kind of authentication you want. For HTTP Authentication, both Basic and Digest, is enough .htaccess and the password file.

But I am not sure if that is what your customer is thinking to.

Feherke.

http://rootshell.be/~feherke/

 

[gbraden]

I reworded the question and posted over at PHP. There is a method called Sessions that restrict access if you cannot provide login/password.

I was looking for a way that a registered user could access more content than one who is not registered. Similar to websites that allow you to read part of an article, but only makes the entire article available to registered users.




Glen Braden

 

[feherke]

Hi

I reworded the question and posted over at PHP.

I saw it. When you move with the discussion from a forum to another, is a good idea to provide a reference in the new thread to the old one.

Feherke.

http://rootshell.be/~feherke/

 

[xmassey]

Ill tell you what, I have a Visual Quick Start guide for PHP and it has lots of examples, including a user authetication system.

However, my main script language is perl... I do all the coding, and store all important info like passwords in a text file. I then secure just the text file with .htaccess... Everything else that needs securing I do with hidden fields, to consistantly check that the username and password they user logged in with is correct, every time they load a page.

 

[feherke]

Hi

Everything else that needs securing I do with hidden fields

Hopefully the content of the hidden fields is just the session id.

Feherke.

http://rootshell.be/~feherke/

 

[xmassey]

Well, no hehe. When the user logs in the first time, when they click login, a hidden field carries the username and password, so once in the admin area, if they click on another button i check if the username and password carried by the hidden field is the same as in the file storing it. This method I devised myself, because I couldn't find anything at the time which told me how to write a proper user login system

 

[feherke]

Hi

a hidden field carries the username and password

Then hopefully they are at least encrypted.

I suggest to read "Login System" by Paul Johnston.

Feherke.

http://rootshell.be/~feherke/

 

[xmassey]

They aren't even encrypted. I don't get why they need to be??? The correct username and password is stored in a text file which is highly secured using htaccess, no one can view the correct username an dpassword