need simple authentication script that works on IIS & apache

[Kurt111780]

Hello,

I need a simple way to authenticate users. If authenticated they can access certain pages. I would like it to work on IIS and apache. Does anyone know of a good tutorial or a place to start for this?

Thanks, Kurt

It's only easy when you know how.

http://www.seedandgarden.com

 

[Chacalinc]

take a look to FAQ faq434-4165



Chacal, Inc.

 

[Chacalinc]

just following the first link of the FAQ:

http://www.hotscripts.com/PHP/Tips_and_Tutorials/Security/index.html

Chacal, Inc.

 

[Kurt111780]

Hi,

This one seems ok

http://forums.phpmini.com/index.php?showtopic=13

but why would they store the username and password in the session. Can someone look at your cookies and find the password?

Kurt

It's only easy when you know how.

http://www.seedandgarden.com

 

[jpadie]

no (at least mostly no). cookies are clientside and unless you change them they typically just store the session id ( altho they can store just about anything you want). the server stores the session info against the id (usually serialised) either in a db or the filesystem, depending how you set it up.

i would not store the pwd in the session unless there was good reason to do so.

i posted a complete (but untested) beginners logon script for another user a few days ago. logincode.no3.co.uk if you want to review it. it is cross-browswer and cross-server of course but it is also written with begiiners in mind to make it easy to grasp what is going on (not saying you're a beginner of course!)

 

[Kurt111780]

Hello,

Is it safe to do the following:

on the login page,

$_SESSION['loggedOn'] = "yes";

on secure pages,

session_start();
if (empty($_SESSION['loggedOn']))
{
		echo "<meta http-equiv='refresh' content='0; url=logon.php'>\n";
 		die("");
}

If not how do I make sure users a logged in on secure pages?

Thanks,
Kurt

It's only easy when you know how.

http://www.seedandgarden.com

 

[jpadie]

that's alright.

but if the relevant session variable is empty then destroy the session first. i would also send a header to redirect the browser rather than use the meta tag.

i am assuming you are dealing with timeouts etc and avoiding the resending of login credentials issue somewhere else.

 

[Kurt111780]

I must be doing something wrong. This isn't ending the session

if ($_GET['exit'] == "true")
{
	unset($_SESSION['mySession']) ;
	if ($_SESSION['mySession']) session_destroy();
	echo "<meta http-equiv='refresh' content='0; url=login.php'>\n";
 	die("");
}

Am I supposed to have this on each page im using session variables

session_name("mySession");
session_start();

It's only easy when you know how.

http://www.seedandgarden.com

 

[jpadie]

just make sure that each page starts with

session_start();

 

[Kurt111780]

ok, I did that but I still don't understand why i can't end the session.

I removed the if statement and have this on the page and the session does not end.

	unset($_SESSION['mySession']) ;
	if ($_SESSION['mySession']) session_destroy();

It's only easy when you know how.

http://www.seedandgarden.com