RE: [PHP] Re: PHP-Based Authentication Security?

.htaccess and pw files are pointless, who wants to maintain potentially 10 or 20 of these things? Furthermore, it's gotta do more than just serve a single file at a time -- that's simple... I needed directly-level security. The solution I came up with was to use a module called mod_auth_any, which (with a little minor adjustment) can execute a PHP script from the console and rely on it's response to grant authentication or not. That gives me Apache-level security without Apache-authentication. John -----Original Message----- From: J Smith [mailto:dark_panda@hushmail.com] Sent: Wednesday, March 06, 2002 3:58 PM To: php-general@lists.php.net Subject: [PHP] Re: PHP-Based Authentication Security? An easier way to do it might be to use HTTP authentication with apache using .htaccess and .htpasswd files, which can be placed in the secure directories. (Or use one global .htpasswd file and have all .htaccess files point to it.) Another possibility would be to set up two PHP scripts, one being some kind of form to enter a username, password, etc., and another to check the input and act as a pass-thru for the file to be downloaded. The second script could look something like this (obviously simplified): if ($authenticated) { header("Content-type: whatever/text"); readfile($filename); } else { print "You can't download this." } Which you would call as something like: http://www.example.com/path/download.php?filename=somefile.txt Obviously, you need to take care of a few security problems, like making sure they don't do something like http://www.example.com/path/download.php?filename=/etc/passwd And you'd have to make sure the file exists and such before sending it out. And determine the MIME type of the file. (I usually do this by extension.) But overall, it would work. I have a similar script, minus the authentication feature. J John Coggeshall wrote: > > Hey all.. > > I've got a question -- I'd like to restrict access to entire > directories based on if the user has been authenticated or not. > Basically, I'd like to set up a auto-include *FROM APACHE* to run a > PHP script prior to sending any documents what-so-ever and only send > the requested document if the PHP script allows it. So.. > > Request Made -> PHP Script Runs -> PHP Checks Authentication -> PHP > says OK -> Apache sends file normally > > Or.. > > Request Made -> PHP Script Runs -> PHP Checks Authentication -> PHP > says NO -> Apache stops dead in it's tracks or displays a HTTP error > > Is this possible? It has to work for any document or MIME type and be > restrictable by directory... (i.e. I just want this happening in a > /secure/ directory) > > John > -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php